Canon exists to make software delivery explicit.
We apply the same standard to Canon itself. These are the principles that guide how Canon handles agents, code, permissions, approvals, validation, and customer ownership.
Truth
Unknown means unknown
Canon does not invent repository settings, deployment commands, security capabilities, reviewers, or other facts it cannot verify. If Canon doesn't know something about your environment, it asks.
No silent substitutions
If a selected model, capability, or reviewer cannot be used, Canon tells you. It does not quietly replace your choice with something else and carry on.
Ready means ready
Canon does not call a system ready when it knows a required part cannot run. A blueprint that is missing a real producer for a required check is not presented as complete.
Authority
Human approval stays human
Canon does not silently replace a required human decision with an AI decision. A gate that requires a person compiles to something a person actually approves.
Authority is not broadened silently
A requirement for a specific person, team, or permission level is not weakened without explicit approval from you. Authority changes are visible decisions, not side effects.
Agents get only the authority they need
Canon requests and grants the minimum access required for each operation. Stages that only need to read code do not get permission to change it.
Code & Evidence
Approvals follow the code
Reviews and approvals apply to the exact code that was evaluated — not to a branch name, a conversation, or an earlier version that has since changed.
Changed code invalidates stale evidence
If the candidate changes, prior reviews, tests, and approvals tied to the old version no longer count. New code earns its own evidence.
Required checks must be real
Canon does not create a required check unless it knows what will produce that check. A gate that nothing can satisfy is a failure Canon surfaces before you ship.
Ownership & Portability
Your files stay yours
Canon does not delete or modify files already committed to your repository because you cancel Runner. What Canon compiled into your repo remains in your repo.
Template updates are opt-in
Existing workflows do not silently change when Canon publishes a new agent template. You review and adopt new versions; nothing shifts underneath a running system.
Runner controls execution, not ownership
Cancelling Runner pauses Canon-managed orchestration. It does not take away your blueprint, your history, or the files Canon generated for you.
See how Canon applies these principles.
Design your engineering system and compile it into the tools your team already uses.