Re-cuts Gate House from deterministic authority plane to the Staff-layer
council where NetKingdom's security and defence doctrine is established,
documented, taught, and supervised.
The decisive argument is now stated in the document itself: a decision point
inside Gate House would place the deterministic authority boundary inside the
non-deterministic management layer, violating INV-02 — the first invariant the
repository exists to defend. access-engine (currently flex-auth) stays the only
policy decision point.
Adds the layer model and the Staff invariant (Staff never touches tooling
directly), a corrected responsibility table that names access-engine,
zone-engine, and the canon repos, the access lane/rule demarcation with
ops-warden and ops-mason, the conformance loop, and falsifiers.
Drops the /authorize surface, policy evaluation order, policy engine
selection, grant storage, revocation, and the technical direction section.
Keeps what no other repo owns: operating modes, the principal/actor/runtime
triple, mandates and ceilings, change dynamics, MCP doctrine, the posture
asymmetry, and the assurance specifications.
Addresses the name/metaphor risk in the opening: the gate house is where the
watch is set and the porter's rules are posted, not the gate itself.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
