Name the top layer Staff rather than Helpers, throughout. Place the layer
model in net-kingdom canon rather than info-tech-canon — it is NetKingdom
security architecture, not general semantic contract.
Record flex-auth's reframing as an Engine with access-engine as the working
rename target, and note the one cost: "access" is already spoken for
operationally by ops-warden and ops-mason, so adopting it requires
demarcating access lanes from access rules in both INTENTs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
Reference note from the 2026-08-28 review of INTENT.md across the security
estate. Establishes the four-layer model (taxonomy / tooling / engines /
helpers), distinguished by determinism and artifact kind, and its
self-similarity to the ASM Canon's three planes.
Key finding: gate-house's authority-plane framing places a deterministic
decision point inside the non-deterministic management layer, violating
INV-02, and collides with flex-auth's declared ownership of authorization.
zone-engine §5 already ruled that flex-auth is the only policy decision
point. Re-cuts gate-house as the doctrine and conformance council.
Not canon and not a decision record; the decisions it recommends still
have to be written and assented to.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
