Context Kubernetes: Declarative Orchestration of Enterprise Knowledge for Agentic AI Systems

TL;DR

Context Kubernetes is a novel architecture that applies container orchestration principles to manage enterprise knowledge in agentic AI systems, ensuring secure and efficient knowledge delivery.

Contribution

It formalizes a knowledge orchestration architecture with declarative manifests, permission models, and safety verification, addressing unique challenges beyond traditional container orchestration.

Findings

Full architecture blocks all tested attack scenarios

Intent routing reduces noise by 19 percentage points

TLA+ model-checking verifies safety with zero violations

Abstract

We introduce Context Kubernetes, an architecture for orchestrating enterprise knowledge in agentic AI systems, with a prototype implementation and eight experiments. The core observation is that delivering the right knowledge, to the right agent, with the right permissions, at the right freshness -- across an entire organization -- is structurally analogous to the container orchestration problem Kubernetes solved a decade ago. We formalize six core abstractions, a YAML-based declarative manifest for knowledge-architecture-as-code, a reconciliation loop, and a three-tier agent permission model where agent authority is always a strict subset of human authority. On synthetic seed data, we compare four governance baselines of increasing strength: ungoverned RAG, ACL-filtered retrieval, RBAC-aware routing, and the full architecture. Each layer contributes a different capability: ACL filtering eliminates cross-domain leaks, intent routing reduces noise by 19 percentage points, and only the three-tier model blocks all five tested attack scenarios -- the one attack RBAC misses is an agent sending confidential pricing via email, which RBAC cannot distinguish from ordinary email. TLA+ model-checking verifies safety properties across 4.6 million reachable states with zero violations. A survey of four major platforms (Microsoft, Salesforce, AWS, Google) documents that none architecturally isolates agent approval channels. We identify four properties that make context orchestration harder than container orchestration, and argue these make the solution more valuable.