Software interfaces are not limited to APIs. Events, configuration, workflows, and tool inputs and outputs also set expectations between independently built components. They are contracts, too—and they often raise the same questions about ownership, versions, permissions, compatibility, and change.
Artifizer’s proposal is to explore a shared type-system layer for these artifacts. It is a design hypothesis, not an established standard: the central challenge is whether common concepts can help without flattening the different needs of each domain.
Why treat more than APIs as contracts?
API engineering has recognizable concerns: define a contract and schema, identify an owner, document and discover it, control access, manage versions and backward compatibility, and plan for breaking changes and deprecation. Artifizer argues that comparable concerns apply wherever one component produces something another component consumes. “These artifacts are contracts too,” the article says.
That broader set includes events; user, tenant, subscription, virtual-machine, application, and integration settings; workflows; serverless function contracts; MCP tools and agents; prompts; policies; extension manifests; and plugin-defined data. The specific mechanics differ, but each artifact can create assumptions across a boundary. If those assumptions are implicit or scattered, a producer and consumer can disagree about what a value means, which version is in use, or who is entitled to access it.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- API Design Patterns
- ABIS BOOK
- Manning Publications
This is an architectural argument, not proof that API practices are uniformly mature across the industry or that every artifact needs the same machinery. The useful question is which contract concerns recur, and which should remain specific to a domain.
How might event contracts fit together?
An event system illustrates the appeal—and the design choices—of making contracts explicit. Artifizer sketches a general Event with a timestamp, tenant ID, event type, and payload. An Audit Event could add a user and IP address; more specific events could include authentication failure and user login.
The important question is what it means for a specific event to satisfy a more general contract. A consumer that understands the common event fields might accept a specialized event, while an audit consumer could rely on the additional identity fields. A schema design has to state which fields are required, how a specialization relates to its parent, and what a consumer can safely assume.
Rank #2
That sketch is an example, not evidence that inheritance is always the right schema-composition technique. Different event systems may need other ways to express shared fields, variants, or compatibility. Whatever the mechanism, the contract should make it clear what a producer promises and what a consumer may depend on.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What changes when the contract is stored configuration?
Configuration adds a lifecycle problem: the platform may store objects that outlive the application version that created them. The proposed platform role is to provide shared storage, validation, versioning, access control, and discovery, while applications, vendors, or plugins define specialized types or add attributes.
That arrangement makes governance concrete. For any stored object, teams need to be able to answer:
- Who owns this data type?
- What does it derive from?
- Which version is stored?
- Who can read it, and who can modify it?
- What happens to old stored objects after the schema evolves?
Schema evolution is not just a question of accepting new writes. Existing objects may need migration, continued support, validation under their original version, or a defined conversion path. A platform that offers version labels without a policy for old instances would leave the hardest operational question unanswered.
What do MCP tool contracts need to say?
A declared input schema can tell a caller the shape of data a tool expects, but it does not settle identity or trust. If a tool accepts a type named Repository, is that a local type, a generic shared type, or one defined by a vendor? Which version does the name refer to? Is a more specific GitHub Repository accepted in its place?
The security question extends beyond whether the data matches the schema. A caller must also decide whether it is permitted to disclose that information to a third-party tool. Consumers of a tool’s output—including downstream agents—need to know what the output represents and whether it is safe to act on or pass along. A well-defined interface can clarify expected structure and behavior; it cannot, by itself, authorize every data flow or make downstream use safe.
Could one type system cover these cases?
Artifizer’s tentative proposal is a shared type-system layer that could give events, schemas, configuration, agents, MCP tools, functions, and workflows common concepts: a name, owner, schema, version, references, permissions, and compatibility. The intended benefit is not merely a common vocabulary. Shared concepts might make artifacts easier to identify, govern, discover, and evolve across component boundaries.
But a common layer is a design direction to investigate, not a proven solution. A single system might reduce duplicated governance, yet it could also impose abstractions that fit some domains poorly or create operational costs of its own. Separate registries or domain-specific standards may be more appropriate in some cases. Any comparison should examine:
- Identity and ownership: Can consumers tell which type a name refers to and who defines it?
- Versioning and compatibility: Are changes and supported relationships between versions explicit?
- References and derivation: Can a contract express dependencies or specialization without implying unsafe substitutability?
- Permissions and data flow: Does governance cover who may read, modify, receive, and act on the data?
- Stored-instance evolution: Is there a workable path for data created under older schemas?
- Discovery and operating cost: Can teams find the right contract without maintaining a shared layer whose coordination burden exceeds its value?
The design goal should be shared meaning where it helps, not uniformity for its own sake. No single registry or type model should be assumed to solve every domain’s lifecycle and authorization needs.
Why good contracts do not guarantee a good system
Contracts make boundaries easier to understand, but system security and reliability depend on more than interface definitions. Google’s Building Secure and Reliable Systems describes a system invariant as “a property that is always true, no matter how its environment behaves or misbehaves.” That kind of guarantee concerns system behavior under adverse conditions, not merely whether an individual request matches a schema.
The book also explains the limits of frameworks: safeguards can prevent certain low-level mistakes without preventing higher-level design errors. Its example is Tink, which can prevent many cryptographic vulnerabilities but cannot stop developers from choosing the wrong cryptographic API—or from not using cryptography at all. Similarly, an artifact registry can help teams define and validate contracts, but it cannot ensure that the surrounding application enforces the right authorization, handles failures correctly, or preserves system-wide invariants.
That distinction keeps the proposal in proportion. Better contracts can improve understanding and coordination; they are one part of designing a secure and reliable system, not a substitute for that design.
Quick Recap
Further reading
- Artifizer, “APIs Are Well Engineered. What About Everything Else?” — the architectural argument and examples behind the proposal.
- Google, Building Secure and Reliable Systems, Chapter 6 — system invariants and the limits of framework-level safeguards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
