Most self-hosted AI platforms run everything in one service. The agent executes, the control plane decides, the database sits right there. One prompt injection that escapes into the runtime, and the attacker is one hop from your Postgres.
I didn't want to ship that. So Parthenon is three services that are deliberately not allowed to talk to everything:
Control Center — the brain. IAM, governance, the Role → SOP → Skill → Tool permission chain. It's the only service with a database connection.
Agent Runtime — the hands. Executes agent code. Stateless, disposable, and it has no database connection at all. It reaches the Control Center through a narrow, authenticated API, and nothing else.
Communication Hub — the nerves. Message routing and notifications between services, so the runtime never needs to know where anything lives.
The payoff is blast radius. The Agent Runtime is the service most likely to get compromised — it runs untrusted tool calls by definition. But when it is, there's nothing there to steal: no database credentials, no IAM state, no history. The worst case is a contained mess, not a breach.
Two things made this actually work in practice:
1. Dual identity. Agents and humans live in separate Keycloak realms with separate OIDC clients. An agent's token can never be mistaken for a human's, and vice versa. Every action in the audit trail is attributable — "which agent did this" is always answerable. That's what makes human-in-the-loop reviewable instead of performative.
2. Observability by default. OpenTelemetry traces, metrics, and logs out of the box. When an agent misbehaves you can see the full call chain, not just the final error.
It's not free. Three services means real orchestration overhead: startup order matters (the runtime and hub need the Control Center up first to bootstrap certificates), and a distributed system is always harder to debug than a monolith. For a solo dev or small team that's a genuine cost. I think it's worth it when the alternative is your database sitting one hop from arbitrary agent code.
The service boundaries, the IAM model, the migration discipline — none of it was accidental. It was spec'd feature by feature through easyspec, a spec-driven dev kit that runs a gated chain of AI agents through a propose → apply → update-master pipeline. The architecture is the output of that process.
- Parthenon repo: https://github.com/hurungang/parthenon
- easyspec repo: https://github.com/hurungang/easyspec
- 59-min feature walkthrough: https://youtu.be/uW4r8Ygj15Y
Top comments (0)