The contracts between systems

Legacy era: contracts in someone’s head

A network of seven public schools operating under one back office, with three reporting platforms all live and none speaking to the others, roughly fifty Google Sheets carrying the semantic data foundation because the BigQuery ETL the prior team had planned never got built, and recruitment running across HubSpot, SchoolMint, PowerSchool, MailChimp, and a call-center workflow with tiered ops and enrollment follow-ups. The CEO needs to see network-level recruitment performance for the next board meeting. The principal needs to see their campus’s funnel. The director of enrollment needs to know which families are stalling and where in the funnel they are stuck. The integration engineering is finishable: consolidate the reporting onto Tableau Cloud, treat the Google Sheets layer as the explicit semantic contract over what remains a legacy stack underneath, define the funnel stages, plumb them through. At the end of that work, the funnel report exists and the dashboard runs.

The harder question is who can vouch for the number when the principal calls and asks why their applicant count moved by twelve in a week. Someone has to know which of the source systems was reconciled when, which sheet version held the most recent definition of “applicant” versus “enrolled,” which call-center status code rolled up to which funnel stage, and what changed in the overnight refresh. In the legacy era that someone is a steward. The contracts were not absent: they were everywhere, in vendor documentation, in file format conventions, in batch cadences, in the append-versus-delete semantics buried in scheduled jobs, in the implicit understanding that “an applicant is who SchoolMint says they are unless HubSpot has them flagged for follow-up.” They simply lived in tacit institutional knowledge, held in the head of the steward who could vouch for a number when a stakeholder was about to act on it. That is not a failure of engineering. It is what legacy-era integration governance was. When the steward left, the integration still ran and the number stopped being actionable, because the contract that connected the integration to the decision had walked out the door.

Move the same problem into a public-sector frame and the fragility shows differently. An Indian state runs four parallel state systems — UDISE+ for the annual school census, NAS for a sample-based achievement survey on a four-year cycle with grade-band shifts between cycles, PGI as a centrally-designed state grading index, and SEQI as a state quality index with its own definitions of the same outcome variables. Technically the four integrate: states submit, the central agencies consolidate, the dashboards land. What can a District Education Officer or a Mandal Education Officer act on, this month, in their block? Each system tells them something different in a different language about overlapping populations on incompatible cycles. The contracts between these four state systems were never written. There is no single steward who holds them. The integration runs. The decision interface does not exist.

The legacy-era test was the steward’s test: can the steward vouch for the number a stakeholder is about to act on, because the implicit contracts held? In K–8 networks the answer was sometimes yes, when one institutional research lead or data manager held the full picture. In multi-ministry state systems the answer was rarely yes, because no single steward held the contracts across four systems owned by four different bodies. Higher education’s legacy era looked more like the school-network case at much larger scale: Banner sitting on top of a legacy database, PeopleSoft Campus Solutions feeding several downstream warehouses, multiple legacy financial systems feeding the budget office on separate cycles. The contracts were implicit, lived in the institutional research team, and were held in the head of a senior IR analyst whose vouching let the Provost and the CFO act on a number. The decision interface was a person. That worked, in the institutions where it worked, only as long as the person stayed and the questions stayed within their working memory.

Modern era: the artifact exists, the council doesn’t

The modern era was supposed to fix this, and at the engineering layer it largely has. The stack is now familiar: Snowflake or Databricks for the warehouse, Fivetran or Airbyte for ingestion, dbt for transformation, a semantic layer for shared definitions, freshness SLAs in the lineage tooling, and data-contract testing in the build pipeline. The contract is now explicit, written, and version-controlled. The artifact exists, in a file, where it can be reviewed.

What changes less than institutions hope is the governance layer on top of the artifact. A youth-mental-health foundation, working with a Snowflake warehouse a prior contractor had stood up at the dev/prod schema layer but never finished integrating data into, had Azure and Qualtrics running as two parallel data-collection platforms, with survey data accumulating across four to six instrument versions of the same construct over multiple years and external standardized survey instruments and public datasets pulled in for context. The activation work was technical — Fivetran connectors, DevOps cleanup, and Snowflake schema design that reconciled the two collection platforms and the instrument versions into a unified semantic layer, with named definitions for what “engaged participant” meant in the canonical schema and how each instrument version mapped into it. At the end of that work, the artifact existed and the integration ran on a defensible cadence. That is the engineering layer.

What turned that work into institutional intelligence was not the schema design. It was the council, however lightweight, that sat on top of it. Who is allowed to ship a change to the “engaged participant” definition? Who has to be told before the change ships? How long does it take for the quarterly report a program officer is about to act on to reflect the change? Is the prior quarter’s figure still defensible after the change, and if not, who explains that to the partner clinicians and the funders before they read the new report? Modern integration gives an institution the contract artifact. It does not give the institution the governance interface that decides who reads the contract, who can change it, and how downstream stakeholders trigger their actions when it changes. Most institutions in this era buy the tooling and skip the council, and end up with no one who can answer the program officer when the number moves and the question is whether to act on it or wait.

The same gap shows up at a different scale and a higher cost stack in behavioral health. A regional behavioral-health agency running Certified Community Behavioral Health Clinic services had to integrate hospital encounter feeds via HL7 v2 and CCDA, a regional Health Information Exchange via FHIR, payer authorizations, the financial system, HR, and a population-health analytics layer. The hybrid HIPAA-compliant design moved source-system feeds through an integration layer where Mirth Connect handled the hospital data, through ETL and validation, into a cloud warehouse with BI on top — and privacy-by-design lived as architectural components rather than afterthoughts, with HIPAA and additional pharma-partner privacy rules at the access layer, consent tracking integrated through the stack, de-identification at extract, and role-based access through the BI layer. The cost stack ran from thousands per integration pipe to hundreds of thousands for population-health management once it had to drive care decisions rather than only describe them. Engineering money buys a lot of pipes. The pipes do not, on their own, buy a decision interface.

The architecture work made the governance question visible in a way the engineering work could not answer. When a clinician at a partner clinic opens the chart and the integrated population-health view shows the patient has had three no-shows in sixty days, what is the contract that says the clinician is allowed to act on that number? At what cadence does the no-show count have to be fresh enough to support an outreach call without first re-checking the source system? When the patient’s status updates at the partner clinic, how long until the central view reflects it, and what action is the clinician expected to take in the lag window? HL7 carries the message. The schema defines the fields. The governance contract (written, agreed, enforced across the partner clinics and the central agency) is what tells the clinician whether the number on their screen is a decision interface or only a description.

A measurement-based-care pilot run through a patient-facing smartphone app, built into the same behavioral-health setting, made the freshness-contract question concrete at clinical cadence. A patient opens the app and completes a brief symptom inventory in the morning; the result lands on the clinician’s dashboard before the day’s appointments, and the clinician adjusts treatment planning based on the symptom trajectory. The dashboard feeds the warehouse, which in turn feeds adherence and engagement analytics. The pilot ran with thirty-plus patients across two waves, produced a forty percent engagement lift after reminder automation, surfaced earlier clinician response, and began to show predictive patterns in adherence and symptom improvement. There is a human clinician acting on integrated data at a faster cadence than weekly review can sustain, and the freshness contract is already what holds that loop together, even with no agent in the cycle. If the morning symptom score reaches the clinician three days late, the treatment planning at the noon appointment is being done on a stale number. The contract that has to be specified is not “the data is integrated.” It is “the cadence at which the patient’s status stays fresh enough for the clinician to adjust treatment planning, and what happens when it slips below that threshold.”

There is a quieter version of this same gap that shows up when the contract author is external. A public charter school operating inside a state’s accountability framework works inside an explicit modern-era integration contract whose author is the state agency itself, which writes the course-collection policy: schools submit course registration, attendance codes, and reporting cadences on the state’s schedule, in the state’s format, against the state’s definitions. The contract is not optional and not invented by the school. The state writes it; the school conforms. That gives the principal a usable decision interface, because they know exactly what counts, why it counts, when it counts, and who reads it. The example matters because most institutional contexts have no equivalent author. There is no state agency writing the contracts inside the foundation, the school network, the regional behavioral-health agency, or the university. If the institution does not write the contracts itself, no one does.

Higher ed’s modern era

Higher education is standing in this same gap at scale right now. Most institutions are standing up (or have stood up) a warehouse, a semantic layer, some dbt, and some lineage, and the integration engineering is largely being done. What is missing is the council that owns the decision interface on top of the artifact, and so the Provost still cannot get a 360 view even after the CIO has built the warehouse. The data governance committee, where one exists, often meets quarterly to debate naming conventions. The decision interface is unowned.

The agentic era: provenance, consent, reversibility

The agentic era changes what the contract has to specify and raises what the stakes are when it does not exist. The freshness-contract pattern that was already central to modern-era clinical loops becomes more demanding when an agent enters the cycle, because the agent acts at machine cadence and the human stakeholder still has to stand behind the action. The earliest agentic example I have worked on is a reporting prototype where Snowflake Cortex reads from governed Snowflake schemas, Streamlit fronts a Python pattern that reads against the warehouse, and Gemini is used at a bounded scope to verify significance-test results and the interpretation of those tests before a human program officer acts on them. Even at that bounded scope (LLM-inferred verification of a statistical claim a human is about to act on) the provenance question already arrives. Was this confidence-interval check produced by a human, by a deterministic test, or by an LLM that may have hallucinated it? Once agentic deployments scale beyond verification into drafting and writing, which is the direction reporting pipelines are heading, the contract has to extend to provenance categories the data-integration era did not have to name. Was this paragraph human-authored, deterministic-pipeline-generated, or LLM-inferred? On the warehouse side, was this record written by a human program officer, by the nightly ingestion job, or by the agent acting on the program officer’s behalf? Provenance is now part of the data, not metadata about it. A program officer reading the impact report has to know which sentences were synthesized and which were sourced, because the question “can I stand behind this when a funder asks” depends on the answer.

The contract has to extend to consent semantics for machine write actions. A human writing to a patient’s chart operates under a known consent envelope — what the patient agreed to at intake, what the clinician’s role-based access permits, what HIPAA’s minimum-necessary rule treats as defensible. An LLM writing to a chart raises a different consent question. Did the patient consent to LLM-inferred annotations on their record? Did the clinician supervise the inference? Can the inference be reversed? What is the audit trail that lets a regulator answer “what wrote this, and when” months after the fact? The data-integration era’s contracts did not have to answer any of those questions. The agentic era’s contracts do, before any agent goes into production rather than after.

Reversibility envelopes are the third extension. When a human writes a wrong number to a record, the institution can undo it through a defined process and a known reviewer. When an LLM writes a wrong number at machine cadence, the institution may have minutes, not days, before downstream stakeholders are already acting on the changed record. The reversibility contract has to specify the window within which a roll-back is possible, the conditions under which it is automatic versus reviewed, and the downstream stakeholders who have to be notified that the records they were acting on may have just moved. The contract is no longer “did the upstream system honor the schema it promised.” It is “if the machine writes something wrong, can the institution take it back before a decision has been triggered on it.”

Higher ed and the agentic era

Higher education is not far from this. Banner-to-Workday-Student transitions are landing. Financial-aid agents reading across multiple systems are landing. Advising assistants writing to advising notes are landing. AI tutors writing to gradebooks are landing. The institution will have the integration. It will have, mostly, the engineering. What it will not have, in most cases, is the contract layer. Who is allowed to write a gradebook entry on behalf of an AI tutor? What is the consent envelope under which a financial-aid agent moves a student between aid scenarios? When the advising assistant writes a recommendation into a student’s record that the advisor never reviewed, what is the reversibility window, and who tells the advisor? The architectural question is the same one the behavioral-health case faces. The systems differ. The contract questions are identical.

The freshness contract becomes load-bearing

The freshness contract (the discipline of treating timestamps not as metadata but as part of the decision) already mattered in the modern era, because reports drove decisions on a weekly or monthly cadence and stale numbers produced wrong reports. In the agentic era it matters in a different way. An LLM acting on stale data at machine cadence produces wrong outcomes faster than a human at the same staleness, and faster than the decision interface can be re-anchored once it has started producing decisions that look fluent and are not. The timestamp is no longer a field next to the record. It is the boundary between an actionable number and a misleading one.

That is what makes integration governance a layer the institution cannot leave to engineering or architecture in any era. Engineering moves the bytes. Architecture stages them. Governance contracts (who reads, who writes, on what cadence, with what consent, with what provenance, with what reversibility, with what authority to act) turn fragmented bytes into decision-ready institutional intelligence stakeholders can stand behind. Without those contracts, the integration runs and the data on the other side stays fragmented to anyone trying to act on it. With those contracts, fragmented bytes become decision-ready intelligence: a 360 view for the CEO, role-specific intelligence for program officers and principals and clinicians and deans and District Education Officers, and a decision interface that triggers action.

The contracts have to be written. By someone, named, inside the institution. Where in the institution that role should sit is a question worth its own treatment, and one I have taken up directly elsewhere. In every era these contracts were already needed. In the next one they will be load-bearing.

This essay was written in June 2026 for the Analytic Bytes Library. It draws on the author’s practice across K–8 charter networks, a youth-mental-health foundation, a regional behavioral-health agency, a DC public charter school context, and Andhra Pradesh state systems. Organizational details are abstracted where appropriate. The argument is intended to outlast specific products and platforms.