Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

wiki/ArchitectureBlueprint.md

@@ -5,7 +5,9 @@ Date: 2026-05-22
 Related product docs: `../INTENT.md`, `ProductRequirementsDocument.md`
 Primary platform references:
 
-- `/home/worsch/net-kingdom/canon/standards/iam-profile_v0.2.md`
+- `https://policy.coulomb.social/standards/iam-profile/v0.3/` (source: `/home/worsch/net-kingdom/canon/standards/iam-profile_v0.3.md`; v0.2 is superseded)
+- `https://policy.coulomb.social/standards/tenancy-posture/v0.1/`
+- `https://policy.coulomb.social/architecture/net-kingdom/v0.1/`
 - `/home/worsch/net-kingdom/docs/platform-identity-security-architecture.md`
 - `/home/worsch/net-kingdom/docs/responsibility-map.md`
 - `/home/worsch/key-cape/SCOPE.md`
@@ -63,10 +65,17 @@ by flex-auth:
 - `iss`, `sub`, `aud`, `tenant`, `principal_type`
 - `groups`, `roles`, `scope` or `scp`
 - `assurance`
+- optional `tenant_roles` (IAM Profile v0.3 cached tenant capability roles;
+  forwarded to flex-auth, never used as a local authorization decision;
+  privileged or `aal2`-class actions must re-query `tenant-engine`)
 - optional human display/contact claims such as `preferred_username`, `email`,
   and `name`
 - optional agent/delegation claims for agentic use cases
 
+A tenant's onboarding grouping (ADR-0013) and its capability roles (ADR-0014)
+are independent. The identifier's grouping segment is historical after a
+reclassification; `tenant_roles` is not encoded in the identifier.
+
 `user-engine` must treat `iss + sub` as the stable identity link key. Email,
 username, or display name must never be primary keys.