Cross-project access, deny-by-default.
Without an active FederatedContract, every cross-project entity read denies. Federation is the lightweight per-entity directional grant — bidirectional needs two contracts, wildcard EntityName='*' is permitted, time-bounded via ExpiresAt and the canonical ExpiryPolicy. The structured complement is installable surfaces — versioned + scoped + billed. Federation is for ad-hoc; surfaces are for products.
Asymmetric. Time-bounded. Auditable.
Per-entity directional grant
FederatedContract carries (SourceProjectId, TargetProjectId, EntityName, AccessMode, GrantedBy, GrantedAt, ExpiresAt, IsActive). Unique on the triple. Bidirectional needs two contracts.
ReadOnly or ReadWrite
AccessMode is typed. ReadOnly grants entity reads; ReadWrite grants reads plus writes. Cross-relation traversal honors the source's access mode.
Wildcard permitted
EntityName='*' grants all entities in the source project. Useful for parent-to-child scenarios where the parent admin needs blanket data access. Always explicit, always auditable.
Active state evaluation
Active = IsActive=true AND no RevokedAt AND ExpiryPolicy.IsNotExpired(now). Fail-closed on malformed dates. ExpiryPolicy is the canonical helper across the platform.
Branchable manifest domain
FederationDiffAnalyzer covers Federation as one of the 19 typed manifest domains. Sandbox a contract change. Three-way merge handles cross-project conflicts.
Governance envelope enforcement
IGovernanceEnvelopeValidator.ValidateFederationContractAsync enforces the descendant envelope's AllowedFederationTargets at mutation time. A child cannot federate beyond what its parent permits.
Deny-by-default
Anti-pattern #31 codified. No active contract → cross-project read denies. There is no implicit traversal across project boundaries — federation is opt-in by design.
Complement to installable surfaces
Federation = simple per-entity grant. Installable surfaces = versioned + metered + state-machined + revocable. The two are designed to coexist; pick the right tool.
Service interface
IFederationService — CreateContractAsync, RevokeContractAsync, HasActiveContractAsync, ListContractsBySourceAsync, ListContractsByTargetAsync. One canonical authority.
Anti-pattern #31 absolute
Bidirectional = two contracts
Fail-closed on malformed dates
Sandbox contract changes
Cross-project access, on purpose.
Issue a contract. Audit the trail. Revoke when the relationship ends. Federation is the simple per-entity grant; installable surfaces are the structured product.