operators/ enabled as KV v2; operator-custody grants read/write on it.
Kept separate from platform-admin rather than folded in, though that
would have been one stanza. platform-admin lists the mounts an
administrator operates *on*; operators/ is the one mount an
administrator keeps things *in*. Separating them lets custody move
independently of administration, which is what the S6 trust stage
(two-of-three independent recovery control) requires and which cannot be
retrofitted once the grant is buried inside platform-admin.
Delete is deliberately absent from the policy. A credential is retired
by writing its successor, and KV v2 keeps the prior version — the
history that did not exist when the LLDAP predecessor was overwritten in
a browser password manager on 2026-08-27 and lost for good.
ops-mason-build verified behaviourally, not just by capability strings:
metadata reads succeed, `kv get` on the forge token returns permission
denied, and enabling a mount returns permission denied.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
