diff --git a/canon/standards/security-layer-model_v0.9.md b/canon/standards/security-layer-model_v0.9.md
index d526497..d5edf46 100644
--- a/canon/standards/security-layer-model_v0.9.md
+++ b/canon/standards/security-layer-model_v0.9.md
@@ -10,7 +10,7 @@ supersedes: canon/standards/security-layer-model_v0.8.md
 owner: gate-house
 publication_owner: net-kingdom
 created: "2026-08-28"
-updated: "2026-10-11"
+updated: "2026-10-22"
 last_reviewed: "2026-10-10"
 review_interval: 3m
 source_revision: "GH-DEC-2026-025; GH-WP-0004-T06-r1"
@@ -233,14 +233,48 @@ performant, scalable keeping of state. Much of it is third-party.
 
 ### 3.3 Engines
 
-Deterministic APIs for a modeled concept — a user, a tenant, a zone, a secret,
-an access rule. An engine's defining property is that **the same authoritative
-input state yields the same result**. Engines are where the estate's
-deterministic guarantees live, and therefore where every enforcement boundary
-MUST sit.
+An engine is a tool of automation for one capability — a user, a tenant, a
+zone, a secret, an access rule. It encapsulates that capability in a
+consistent, often simpler interface than doing the work by hand. Its defining
+property is that **the same authoritative input state yields the same
+result**. That determinism is where the estate's deterministic guarantees
+live. It reduces failure modes and makes the work more reliable and more
+efficient. Accepted in gate-house ADR-015 (2026-10-22).
 
-A repository whose core function is inference or judgment fails this test by
-construction and is Staff, however much of its work happens at runtime.
+The canon states the domain. The engine implements the capability. Tooling
+holds the records. Several engines may use one store, each for a different
+capability. An engine does not hold the records, and being an engine does not
+make it the store's only client.
+
+An engine enables its capability. It is not, by being an engine, an
+access-control mechanism. Restricting who may act is `access-engine`'s domain
+(§6). `access-engine` is an engine because deciding is its capability, not
+because the engine layer restricts.
+
+A repository whose core function is inference or judgment fails the
+determinism test by construction and is Staff, however much of its work
+happens at runtime.
+
+One library has three manifestations. The library performs the capability.
+The CLI runs that library in a process. A service is the same process kept
+running for one scoped environment. At start, the process is injected with
+the credential for that one environment. The credential enables the capability
+and is not returned to the caller. A kept-running process is required only
+when a scoped environment needs a standing manifestation. A one-task
+environment uses the CLI.
+
+An operator is a Staff actor who starts or calls an engine. Authentication
+establishes who the operator is. Permission to use one named instance, or a
+named set of instances, is an access rule rendered by `access-engine`. That
+use-privilege does not confer the injected credential. The engine does not
+decide the permission and does not become a gate on the store.
+
+An operator allowed to delegate may assign a task to another operator who
+holds a use-privilege the delegator does not hold. Delegation assigns the
+work. It transfers neither the use-privilege nor the injected credential. The
+delegate must already hold the use-privilege. Operators stay flexible and are
+expected to be reliable in what they choose and assign. That reliability does
+not add a restriction inside the engine.
 
 **Engines are typed.** "Engine" is one layer but four roles, and collapsing them
 hides different failure modes. Every §4 Engine row carries a role:
@@ -250,7 +284,7 @@ hides different failure modes. Every §4 Engine row carries a role:
 | **PDP** | renders the authorization decision — `access-engine`, and only it (§6) | consumer residue (§9.3) |
 | **PIP** | supplies facts a decision consumes as claims — user, tenant, zone, approval, maturity | input degradation, engine's own fallback (§9.3) |
 | **Evidence** | records what happened and proves integrity of what it holds — `audit-core` | MUST NOT block the operation being recorded — a default, not a property; see below |
-| **Lifecycle** | a deterministic API over Tooling it owns — `secrets-engine` | the owning engine's failure semantics |
+| **Lifecycle** | a deterministic capability over a Tooling store — `secrets-engine`. The store may serve other engines. | that engine's failure semantics |
 
 The roles are why *"we need an engine for X"* does not mean *"X now decides"*.
 A new engine is a PIP unless this standard is amended to say otherwise, and §6
@@ -1567,8 +1601,12 @@ follow-up. Settled in `GH-DEC-2026-006`.
 
 Status is **proposed**. Accepted v0.8 at SHA256
 `3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b` remains
-operative and immutable. This successor source assembles only GH-DEC-2026-025's
-approved bounded §3.4 and §4 candidate. Confirmed founder acceptance of memo
+operative and immutable. This successor source assembles GH-DEC-2026-025's
+approved bounded §3.4 and §4 candidate, and, separately, the §3.3 engine
+wording of accepted gate-house ADR-015. The bounded-doctrine pin covers the
+staff-evidence candidate only. ADR-015 does not adopt this revision.
+
+Confirmed founder acceptance of memo
 `infd-20261011-staff-evidence-tension`, version1, approval
 `d90c899b-f25c-4e66-a003-808ee5b1324f`, at2026-10-11T01:46:25Z is the bounded
 doctrine disposition, not acceptance of this whole revision. Source-owner
@@ -1669,6 +1707,15 @@ basis. Declaration requests are open as intakes in each.
 
 ## 15. Change log
 
+**2026-10-22 §3.3 engine amendment:** Accepted gate-house ADR-015 replaces the
+§3.3 opening and the Lifecycle role. An engine enables one capability. Tooling
+holds the records. Several engines may use one store. An engine is not an
+access-control mechanism by being an engine. Library, CLI, and service are
+manifestations of one implementation. Operator use is an access-engine rule
+and does not confer the credential injected at start. Delegation assigns work
+and transfers neither privilege. Accepted v0.8 is not patched. The §4 catalog
+is unchanged. This entry does not adopt the revision.
+
 **2026-10-11 proposed successor assembly:** GH-DEC-2026-025's exact approved
 candidate adds the carried Staff/deterministic-presentation-evidence tension in
 §3.4, the informed-decision Staff/PEP-shaped evidence-source=yes row, explicit