docs(canon): reconcile workload and tenant grouping semantics

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

canon/standards/iam-profile_v0.3.md

@@ -5,11 +5,11 @@ title: "NetKingdom IAM Profile v0.3"
 domain: netkingdom
 status: accepted
 owner: net-kingdom
-last_reviewed: "2026-07-23"
+last_reviewed: "2026-08-22"
 review_interval: 6m
 version: "0.3"
 created: "2026-07-23"
-updated: "2026-07-23"
+updated: "2026-08-22"
 scope: core-platform
 supersedes:
   - canon/standards/iam-profile_v0.2.md
@@ -236,7 +236,7 @@ flex-auth resource/action semantics.
 `tenant` is required for every token accepted by profile consumers.
 
 Tenant identifiers follow `tenant:<grouping>:<name>`, where `<grouping>` is
-one of the taxonomy ratified by ADR-0013:
+one of the taxonomy ratified by ADR-0013 at identifier creation:
 
 ```text
 trial        - test/trial/showcase tenants only
@@ -265,9 +265,14 @@ request MUST identify the tenant context for that request. If a client
 needs to switch tenant context, it obtains a new token or uses an
 approved token-exchange flow that records the target tenant.
 
-The grouping segment is **onboarding-risk / entity-shape** classification
-only. It does not gate which capability roles (below) a tenant may hold —
-see Tenant Roles.
+The grouping segment is an immutable record of the tenant's
+**onboarding-time** onboarding-risk / entity-shape classification. It remains
+vocabulary-valid but becomes historical if the tenant's classification later
+changes. The authoritative current grouping is the `grouping` field held by
+`tenant-engine`; consumers MUST NOT split `tenant` and treat its middle segment
+as current policy input. Changing current grouping never renames the tenant.
+Neither the historical segment nor current grouping gates which capability
+roles (below) a tenant may hold — see Tenant Roles.
 
 ## Tenant Roles