diff --git a/INTENT.md b/INTENT.md
index 8640a27..0430d5d 100644
--- a/INTENT.md
+++ b/INTENT.md
@@ -1,5 +1,20 @@
 # Flex-Auth Intent
 
+> **NetKingdom layering review — 2026-08-28.** This repository's role was reviewed
+> against the NetKingdom IT-security layer model: **Taxonomy → Tooling → Engines →
+> Staff**, layered by determinism and by the kind of artifact each layer produces.
+> Findings and the argument behind them:
+> `gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md`.
+> The model as currently stated is `gate-house/INTENT.md` § "Where Gate House Sits";
+> it is ruled to become a `net-kingdom/canon/standards/` standard, not yet written.
+>
+> The layer rule that binds every repository: **Staff never touches tooling
+> directly. It acts only through engine APIs.**
+>
+> **This repository is Engine — and the only policy decision point in NetKingdom.** The largest adaptation of the review. (1) **Rename to `access-engine`** — ruled, with sequence: reframe this INTENT first, rename second as a governed migration, since the rename touches `FLEX-WP` prefix ownership, State Hub identifiers, ops-warden's tables, zone-engine's binding boundary text, and secrets-engine integrations. `auth-engine` was rejected because key-cape owns authentication and `auth-` keeps the ambiguity. (2) **Drop the "control plane" self-description** — that is Staff vocabulary for an Engine-layer repository. (3) **Split policy authoring from policy evaluation**: authoring, governing, and versioning policy is Staff work (gate-house); evaluating it deterministically and in-path is this repository's, and stays exclusively so. This is the constructive resolution of the `FLEX-WP-0017` overlap — gate-house designs the approval contract, access-engine validates approvals at decision time. (4) Consume gate-house's **authority context** (principal / actor / runtime identity / mandate / operating mode) as input claims. (5) Record the demarcation: **ops-warden and ops-mason own access lanes; access-engine owns access rules.**
+>
+> *This note records what should change. The body below is not yet adapted.*
+
 > This file captures **why this repository exists**, the **direction it is
 > moving toward**, and the **kind of system it is meant to become**.
 > It is intentionally **aspirational and stable**, not a description of