docs(reuse): establish reviewed NetKingdom security capabilities

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

registry/capabilities/capability.authorization.policy-evaluate.md

@@ -1,24 +1,32 @@
 ---
 id: capability.authorization.policy-evaluate
-name: Authorization Policy Evaluation
+name: Policy evaluation and decision evidence
-summary: Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.
+summary: Check, batch, list-allowed, explain, binding, lifetime and decision records.
-owner: flex-auth
+owner: access-engine
 status: draft
 domain: helix_forge
-tags: [authorization, policy, flex-auth]
+tags:
-
+- authorization
+- policy
+- flex-auth
+- security
+- netkingdom
+- framework-reuse
 maturity:
   discovery:
     current: D4
     target: D6
     confidence: medium
-    rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth path.
+    rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth
+      path.
   availability:
-    current: A2
+    current: A4
     target: A5
     confidence: low
-    rationale: Policy registry and evaluation logic exist in repo; service packaging evolving.
+    rationale: 'Source interface assessed 2026-10-14: Check, batch, list-allowed,
-
+      explain, binding, lifetime and decision records. Availability describes the
+      delivery form, not production acceptance. One PDP owner with per-consumer deployments;
+      signed envelope production and consumer adoption are distinct.'
 external_evidence:
   completeness:
     level: C2
@@ -26,55 +34,102 @@ external_evidence:
     confidence: low
     basis: scope_vs_intent_and_consumer_expectations
     satisfied_expectations:
-      - policy-as-code intent documented
+    - policy-as-code intent documented
     broken_expectations:
-      - not yet indexed from flex-auth native registry
+    - not yet indexed from flex-auth native registry
     out_of_scope_expectations:
-      - identity proofing
+    - identity proofing
   reliability:
     level: R1
     confidence: low
     basis: consumer_quality_signals
     known_reliability_risks:
-      - early implementation phase
+    - early implementation phase
-
 discovery:
-  intent: >
+  intent: Check, batch, list-allowed, explain, binding, lifetime and decision records
-    Provide inspectable authorization decisions between verified identity and
-    protected resources using policy-as-code.
   includes:
-    - policy evaluation
+  - Check, batch, list-allowed, explain, binding, lifetime and decision records
-    - authorization registry
-    - decision explainability
   excludes:
-    - identity issuance
+  - One PDP owner with per-consumer deployments; signed envelope production and consumer
-    - authentication protocols
+    adoption are distinct
-  use_cases: []
+  use_cases:
-
+  - 'U03: Application combines identity, tenant and resource facts and enforces a
+    bound decision'
+  - 'U04: Protected operation obtains and consumes exact human approval before its
+    side effect'
+  - 'U05: Operator provisions and delivers a scoped workload credential through the
+    approved owner lane'
+  - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
+    connectivity'
 availability:
-  current_level: A2
+  current_level: A4
   target_level: A5
   current_artifacts:
-    - flex-auth/
+  - SCOPE.md
+  - README.md
   consumption_modes:
-    - source module
+  - HTTP API
-
+  - source
 relations:
   depends_on:
-    - capability.identity.subject-resolution
+  - capability.identity.subject-resolution
   related_to:
-    - capability.feature-control.evaluate
+  - capability.feature-control.evaluate
-
+  - capability.security.approval-lifecycle
+  - capability.iam.key-cape
+  - capability.identity.tenant-facts
+  - capability.security.zone-reference
+  - capability.security.maturity-claims
 consumer_guidance:
   recommended_for:
-    - planning authorization layer between identity and resources
+  - Application combines identity, tenant and resource facts and enforces a bound
+    decision
+  - Protected operation obtains and consumes exact human approval before its side
+    effect
+  - Operator provisions and delivers a scoped workload credential through the approved
+    owner lane
+  - Operator or automation obtains a bounded SSH certificate and maintains private
+    connectivity
   not_recommended_for:
-    - feature visibility toggles without policy intent
+  - One PDP owner with per-consumer deployments; signed envelope production and consumer
+    adoption are distinct
   known_limitations:
-    - maturity evidence is registry-external today
+  - One PDP owner with per-consumer deployments; signed envelope production and consumer
+    adoption are distinct
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
+promotion_history:
+- date: '2026-10-14'
+  dimension: availability
+  from: A2
+  to: A4
+  rationale: Interface-form reassessment from current owner sources; no completeness/reliability
+    promotion.
+  author: codex
+evidence:
+  documentation:
+  - SCOPE.md
+  - README.md
 ---
 
-# Authorization Policy Evaluation
+# Policy evaluation and decision evidence
 
-Policy evaluation from flex-auth sits between identity resolution and protected
+Check, batch, list-allowed, explain, binding, lifetime and decision records.
-systems.
+
+## Reuse boundary
+
+One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct.
+
+## Supported use cases
+
+- U03: Application combines identity, tenant and resource facts and enforces a bound decision
+- U04: Protected operation obtains and consumes exact human approval before its side effect
+- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
+- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
+
+## Evidence and integration
+
+- [SCOPE.md](../../SCOPE.md)
+- [README.md](../../README.md)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

registry/indexes/capabilities.yaml

@@ -1,19 +1,22 @@
 version: 1
-updated: '2026-06-16'
+updated: '2026-10-14'
 domain: helix_forge
 capabilities:
 - id: capability.authorization.policy-evaluate
-  name: Authorization Policy Evaluation
+  name: Policy evaluation and decision evidence
-  summary: Evaluate access decisions from policy-as-code rules for subjects, resources,
+  summary: Check, batch, list-allowed, explain, binding, lifetime and decision records.
-    and actions.
-  vector: D4 / A2 / C2 / R1
   domain: helix_forge
   status: draft
-  owner: flex-auth
+  owner: access-engine
-  path: registry/capabilities/capability.authorization.policy-evaluate.md
   tags:
   - authorization
   - policy
   - flex-auth
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A4 / C2 / R1
+  path: registry/capabilities/capability.authorization.policy-evaluate.md
   consumption_modes:
-  - source module
+  - HTTP API
+  - source