Scrydon
Authoring: Org KB

Pack manifest — knowledgebases (domains)

Declare org-KB domains in your Pack manifest with retention, immutability, read policy, promotion policy, and trigger conditions

A Scrydon Pack declares one or more org-KB domains via the knowledgebases[] array in its manifest. (A domain is one governed partition of the organization knowledgebase — "domain" is the term used in the platform UI; "partition" is the same thing internally.) When the Pack is installed the platform creates those domains, compiles the corresponding access-control policies, and wires each domain to the ontologies the Pack ships.

Domains can only be provisioned by installing a Pack — there is no "create domain" button in the platform. This keeps each domain's governance (read policy, promotion policy, retention, immutability) authored and versioned in one place.

Full annotated example

The example below declares a learnings domain for a knowledge-management Pack. It sets a 5-year retention window, restricts read access by classification and role, configures a promotion policy with one required reviewer, and auto-files a promotion when a source Project row is marked validated.

import { defineScrydonPack } from '@scrydon/sdk-authoring/packs'

export default defineScrydonPack({
  package: {
    id: 'com.example.knowledge-pack',
    version: '1.0.0',
    displayName: 'Knowledge Pack',
  },

  knowledgebases: [
    {
      // Required — unique within this org, lowercase kebab-case.
      slug: 'learnings',
      displayName: 'Project Learnings',
      description: 'Durable project learnings.',

      // Which ontologies type the rows in this domain. Each slug must match an
      // ontology shipped by THIS Pack (the installer resolves slugs against the
      // pack's own ontology id).
      ontologies: ['com.example.knowledge-pack'],

      // Where rows are persisted. Org-KB content is tabular in StarRocks —
      // 'starrocks' is the only backend, and this field is optional (it
      // defaults to 'starrocks', so you can omit it entirely).
      storageBackend: 'starrocks',

      defaults: {
        // How long rows are retained before the retention sweep removes them.
        // Number of days. Omit for indefinite retention.
        retentionDays: 1825, // 5 years

        // Once true, rows can only be revoked — never overwritten by a later
        // promote. This flag cannot be relaxed after install (one-way ratchet).
        immutable: false,

        readPolicy: {
          // Properties classified above this level are redacted at read time
          // for callers without elevated privilege.
          // One of: 'public' | 'internal' | 'confidential' | 'restricted'.
          maxClassification: 'internal',

          // Org-scoped roles required to read this domain at all. Optional.
          requiredRoles: ['org:analyst', 'org:knowledge-lead'],
        },

        promotionPolicy: {
          // Minimum explicit approvals before materialization. 0 = auto-approve.
          requiredApprovals: 1,

          // Named reviewer slots filled from specific roles. The platform
          // resolves actual users at request-creation time (snapshot).
          // NOTE the field is `required` (a count), not `count`.
          roleSlots: [
            { role: 'org:knowledge-lead', required: 1 },
          ],

          // How long (seconds) a promotion request may sit pending before it
          // expires.
          expirationSeconds: 604800, // 7 days

          // Auto-file a promotion request when a workspace row matches.
          // An array of per-object-type trigger entries (see "Conditions").
          autoPromoteWhen: [
            {
              objectTypeSlug: 'Project',
              conditions: [
                { kind: 'property', property: 'status', equals: 'validated' },
              ],
            },
          ],

          // Approve a pending request without a human reviewer when the source
          // rows match. Same shape as autoPromoteWhen.
          autoApproveWhen: [
            {
              objectTypeSlug: 'Project',
              conditions: [
                { kind: 'property', property: 'value', equals: 'low' },
                { kind: 'lifecycle', equals: 'short' },
              ],
            },
          ],
        },
      },
    },
  ],

  // ... ontology and process-flow entries as usual
})

A complete, installable starter Pack declaring three domains (learnings, contracts, incidents) is ready to download: org-kb-starter.scrydon-pack.tar.gz. Install it from Settings → Packs to populate the Domains tab. The overview covers the full lifecycle.

Conditions

autoPromoteWhen and autoApproveWhen are both arrays of trigger entries. Each entry targets one object type and carries a list of conditions:

{
  objectTypeSlug: 'Project',     // the source object type this entry applies to
  conditions: [ /* … */ ],   // evaluated AND-wise within the entry
}
  • Within a single conditions[] array, all conditions must hold (logical AND).
  • Across entries in the autoPromoteWhen[] / autoApproveWhen[] array, any matching entry fires (logical OR).

There are two condition kinds, discriminated by kind.

kind: 'property' — match a property on the source row

{
  kind: 'property',
  // The property slug on the object type (not a dotted path).
  property: 'status',

  // Provide exactly one matcher:
  equals: 'validated',           // exact string / number / boolean match
  // matches: 'Enterprise',      // ECMAScript regex against the property value
  // olderThan: '90d',           // duration <N>(s|m|h|d); true if the value is a
  //                             // timestamp older than now - duration
}
// Match projects whose name contains "Enterprise"
{ kind: 'property', property: 'name', matches: 'Enterprise' }

// Match rows created more than 90 days ago
{ kind: 'property', property: 'createdAt', olderThan: '90d' }

kind: 'lifecycle' — match the AI-assigned lifecycle classification

The platform's lifecycle classifier assigns each row a classification advisory — one of long, short, or unknown. This classification is advisory only: it never triggers automatic deletion, and a human can always override it.

{
  kind: 'lifecycle',
  equals: 'long',          // 'long' | 'short' | 'unknown'
  minConfidence: 0.9,      // optional — require the classifier confidence ≥ threshold
}

Combining conditions

There are no all / any combinator objects. AND is expressed by listing multiple conditions in one entry; OR is expressed by listing multiple entries:

autoPromoteWhen: [
  // Entry A: validated AND high-confidence long-lived  → fires
  {
    objectTypeSlug: 'Project',
    conditions: [
      { kind: 'property', property: 'status', equals: 'validated' },
      { kind: 'lifecycle', equals: 'long', minConfidence: 0.8 },
    ],
  },
  // Entry B: strategic priority (OR with entry A)         → also fires
  {
    objectTypeSlug: 'Project',
    conditions: [
      { kind: 'property', property: 'priority', equals: 'strategic' },
    ],
  },
]

Field reference

knowledgebases[] top-level fields

FieldTypeRequiredDescription
slugstringYesUnique identifier for this domain within the org. Lowercase kebab-case. Used in API calls.
displayNamestringYesHuman-readable name shown in the Domains tab and review queue.
descriptionstringNoShort description shown in the UI.
ontologiesstring[]YesSlugs of ontologies (shipped by this Pack) that type the rows stored here. Must reference this Pack's own ontology id.
storageBackend'starrocks'NoWhere rows are persisted. Org-KB content is tabular in StarRocks; this is the only value and it defaults to 'starrocks', so you can omit it.
retrievalIndex{ kind: 'pgvector' | 'starrocks' | 'none' }NoRetrieval index backing for governed search.
defaultsobjectYesGovernance defaults applied at install time. Orgs can override per domain in Settings.

defaults fields

FieldTypeDescription
retentionDaysnumberDays before rows are eligible for the retention sweep. Omit for indefinite retention.
immutablebooleanIf true, rows cannot be updated after materialization — only revoked. One-way: cannot be set back to false after install.
readPolicy.maxClassification'public' | 'internal' | 'confidential' | 'restricted'Maximum property classification visible without elevated privilege. Properties above this level are redacted.
readPolicy.requiredRolesstring[]Org-scoped roles required to read this domain. Optional.
promotionPolicy.requiredApprovalsnumberMinimum explicit approvals before materialization. 0 = auto-approve.
promotionPolicy.roleSlots{ role: string; required: number }[]Named reviewer slots. Note the field is required, not count.
promotionPolicy.expirationSecondsnumberSeconds before a pending request expires without a decision.
promotionPolicy.autoPromoteWhen{ objectTypeSlug: string; conditions: Condition[] }[]Auto-file a promotion when a workspace row matches.
promotionPolicy.autoApproveWhen{ objectTypeSlug: string; conditions: Condition[] }[]Auto-approve a pending request when the source rows match.

What happens at install

When a Pack containing knowledgebases[] is installed:

The platform creates an org_knowledgebase row for each declared domain that doesn't already exist, recording the originating Pack version.

The platform compiles read, promote, and revoke Rego policies from the readPolicy and promotionPolicy declarations and loads them into the policy engine. Policy compilation is injection-guarded — slug and role values are validated before Rego generation.

If a domain with this slug already exists (re-install or upgrade), the platform applies the strictness ratchet: stricter settings (higher requiredApprovals, narrower requiredRoles, enabling immutable) are applied silently. Looser settings are deferred and flagged for admin review — they do not apply automatically on upgrade.

If immutable: true, the flag is permanently set on the domain. It cannot be cleared by a later Pack upgrade or admin action.

The immutable flag is a one-way ratchet. Once a domain is marked immutable — either by the Pack manifest or by an admin — it stays immutable for the lifetime of that domain. Design your domains accordingly.

Where to next

On this page

On this page