---
title: "ADR 0010: External bindings and succession preserve distinction"
description: "Give adapters field-level authority, keep canonical objects after projection loss, and make succession non-escalating."
navLabel: "ADR 0010"
order: 110
nav: false
eyebrow: "Decision"
status: "accepted"
theme: "main"
visibility: "public"
---

## Context

Linear issues, email messages, provider identities, model processes, and custodians may disappear or be replaced. Canonical Pre continuity cannot depend on an external object's survival or imply that a replacement inherits every permission.

## Decision

An external binding maps one canonical object to one provider object and declares field-level direction, external write mode, and conflict policy. Adapter authority applies only to named fields. Unlisted, security-sensitive, or canonical-only fields are denied.

External writes may apply, propose, or produce an explicit conflict. Deletion of the external object marks the projection missing; it never deletes canonical history by implication.

Succession is an explicit relation between predecessor and successor with scope, continuity claims, authorizing reference, effective time, reason, and supersession history.

Succession always records `authorityTransferred: false`. Identity, capability, membership, and context authority require their own new records. Continuity does not equal numerical identity, and replacement does not equal privilege inheritance.

## Consequences

- adapters remain replaceable projections rather than owners;
- field-level policies avoid granting whole-object control for one useful integration;
- conflicts and external deletion are reconstructable;
- model, agent, device, and custodian replacement can preserve attribution and obligations;
- succession cannot become an accidental privilege-escalation path.