diff --git a/INTENT.md b/INTENT.md
index d8e7ee0..48544c9 100644
--- a/INTENT.md
+++ b/INTENT.md
@@ -74,11 +74,22 @@ service — not an afterthought added later.
 Secret material is held and delivered through a dependable authority,
 never scattered across the consumers that need it.
 
+In OAS terms this layer carries **Q1 Security and Compliance** on the Quality
+dimension — approval gates, delegated apply, revocation semantics, and
+front-door readiness. That practice was built before the dimension was named;
+naming it does not change what S3 does, it makes the responsibility legible to
+the rest of the fleet.
+
 ### 5. Operable and Observable
 
 Every service is monitored, recoverable, and diagnosable as a first-class
 property.
 
+Observability itself is **not** this layer's to own. It is **Q2** and belongs to
+`railiance-telemetry`; S3's obligation is to *emit* through the standard
+contract rather than to build its own monitoring. The recoverability half is
+**Q3**, currently unowned across the fleet.
+
 ### 6. Independently Evolvable
 
 The layer can adopt new operators or engines, and migrate between them,