# RightOS + RightFlow — Architecture Decision Guide

- date: 2026-07-13
- related: [Architectural Scope](./RIGHTOS_RIGHTFLOW_ARCHITECTURAL_SCOPE.md), [Concept Guide](./RIGHTOS_RIGHTFLOW_CONCEPT_GUIDE.md)
- Web: https://rightos.i-s3.com/software/rightos/docs/decision

Sometimes the right answer is **not** to use RightOS + RightFlow.

---

## Outcomes

| Code | Meaning |
| --- | --- |
| **A** | RightOS only |
| **B** | RightFlow only |
| **C** | RightOS + RightFlow |
| **D** | Simpler integrated architecture (one authority owns permission + coordination ± execution) |
| **E** | Device-local or execution-specific system (safety / continuous control / local mutex) |

---

## Decision tree

### Step 0 — Hard exclusions → **E**

Ask:

1. Is the required loop **sub-second** or **safety-critical immediate** (e-stop, collision avoidance, clinical interrupt, servo/torque)?
2. Is the problem **continuous control** (platoon coupling, trajectory correction)?
3. Is the resource exclusion **device-owned** (cabinet lock, local mutex)?

If **any** yes → **E**. Stop.

---

### Step 1 — Single legitimate owner → **D**

Ask:

4. Does **one** legitimate authority already own permission, coordination, and execution (closed FMS, single SaaS flag service, platform-native CI permissions+workflow)?

If yes → **D**. Keep a simpler integrated design.

---

### Step 2 — Need durable coordination without independent rights?

Ask:

5. Do tasks **outlive** a single synchronous call?
6. Is **delegation / reassignment / exchange** required among actors?
7. Are execution systems independently controlled?
8. Can a **third party** propose plans that must **not** mint authority?

If 5–7 are mostly no, and rights are only trivial ACLs inside one app → prefer **D**.

If coordination is needed but rights are entirely external and never gated by I-S3 → consider **B** only if you still want proposal/assignment state machines; otherwise **D**.

---

### Step 3 — Independent rights lifecycle?

Ask:

9. Can authorization **change independently** from assignment (revoke, expire, window end)?
10. Are there **multiple authorities** whose disagreement must remain visible?
11. Must execution re-check MAY after time has passed?

If **9–11** are yes → you need RightOS in the picture (**A** or **C**).

If you only issue/verify/transfer rights with **no** cross-actor assignment protocol → **A**.

---

### Step 4 — Combine → **C**

Choose **C (RightOS + RightFlow)** when:

- multiple independent actors **and**
- rights authority is separate from the coordinator **and**
- asynchronous tasks / proposals matter **and**
- execution is outside the coordinator **and**
- Steps 0–1 did not force **E** or **D**.

This is the **default I-S3 architecture inside its positive scope**, not a universal default for all software.

---

## Quick reference matrix

| Situation | Choice |
| --- | --- |
| Issue/verify/transfer operational rights only | **A** |
| In-org task board with no independent rights product | **D** or thin **B** |
| Multi-vendor reassignment gated by facility rights | **C** |
| Open-RMF-only single campus fleet | **D** (or RMF); optional thin wrap |
| Agent tool ACL inside one runtime | **D** |
| Cross-principal agent delegation with revocable authority | **C** (or A2A + external PDP; still not merge) |
| EV charger paid booking + live queue | **C** + external payments (**not** money in RightFlow) |
| Motor torque next cycle | **E** |
| Break-glass evacuate | **E** then reconcile to **C**/**A** |

---

## Anti-patterns

- Choosing **C** because the pitch deck mentions robots or AI.
- Choosing **C** to “look architectural” inside a closed single controller.
- Putting safety in RightFlow to “keep one brain.”
- Letting an optimizer write RightOS rights.
- Treating assignment as eternal permission.

---

## After you choose

| Choice | Next check |
| --- | --- |
| **C** | Read boundary contracts L1–L9 in the scope document |
| **D** / **E** | Document why; do not force-fit later without new authorities |
| **A** | Keep callers from adding a shadow task layer that mints rights |
| **B** | Ensure you are not smuggling authorization into Flow metadata |