Production readiness proof surface
Runtime Deployment Model
Answers where the runtime runs, how agents are promoted, how LaunchPad and Yala fit, and what gates must pass before controlled production use.
Deployment path
01
Developer
Build agent, policy pack, domain config, tests, and evaluation suite.
v
02
Registry
Register agent, MCP tools, A2A contracts, owner, risk class, and data dependencies.
v
03
LaunchPad
AI inventory, risk classification, governance review, evaluation status, red-team status.
v
04
Yala
Approved deployment path, environment config, secrets injection, policy gates, release controls.
v
05
Azure / AWS
Runtime services deployed into tenant-approved cloud boundaries and network controls.
v
06
Runtime
Agent execution, policy enforcement, observability, replay, recovery, and support.
Promotion gates
| Gate | Control |
|---|---|
| Architecture | TDR readiness, reference architecture, integration pattern, recovery design. |
| Data | Data product, lineage, quality, certification, and interface contract approval. |
| Identity | Entra identity, RBAC/ABAC, SoD, access expiry, and recertification approval. |
| Governance | Policy, control, evidence, replay, evaluation, and red-team coverage. |
| Operations | Runbook, support queue, SIEM forwarding, DLQ, rollback, and incident route. |
Production support hooks
RunbookSIEM forwardingRuntime dashboardsQueue healthDLQRollbackIdentity revocationReplay package
Workshop answer
Sphere does not bypass tenant deployment controls. Agent and runtime promotion pass through registry, LaunchPad governance, Yala deployment gates, cloud boundary controls, observability, and support runbooks.
Proof links
Control Plane
Agent Inventory
Agent Identity Runtime
Technology Pack