Name access-engine as the only authorization decision point.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f

INTENT.md

@@ -12,7 +12,8 @@ interfaces, and dependencies so humans and agents can answer questions like:
 
 - Which service provides runtime secrets?
 - Which repos consume the NetKingdom IAM Profile?
-- What breaks if the flex-auth decision envelope changes?
+- What breaks if the access-engine decision envelope changes? The repository
+  is still `flex-auth`.
 - Which workloads require OpenBao KV, dynamic database credentials, or
   object-storage credential vending?
 - Which dependencies are declared, missing, stale, or boundary-violating?
@@ -99,7 +100,7 @@ local declarations.
 A deployable or callable unit produced by a repository. A repo may produce zero
 or more services.
 
-Examples: OpenBao, key-cape, flex-auth API, Topaz deployment, artifact-store.
+Examples: OpenBao, key-cape, the access-engine API (repository `flex-auth`), Topaz deployment, artifact-store.
 
 ### Capability
 
@@ -186,7 +187,8 @@ It complements:
 - `railiance-platform`, which deploys shared S3 services such as OpenBao,
   PostgreSQL, Valkey, and object storage.
 - `net-kingdom`, which owns identity, credential, and security architecture.
-- `flex-auth`, which owns authorization policy and decision semantics.
+- `access-engine` (repository `flex-auth`), which owns authorization policy
+  and decision semantics. It is the only decision point.
 
 ## Non-Goals
 
@@ -224,7 +226,7 @@ Show all consumers of OpenBao.
 Show missing providers for production Railiance.
 Show every service that depends on NetKingdom identity claims.
 Show all interfaces crossing from S3 platform services into S5 applications.
-Show blast radius for changing flex-auth decision envelope v1.
+Show blast radius for changing the access-engine decision envelope v1.
 Show runtime readiness for tenant:coulomb onboarding.
 ```