# zone-engine

Headless authority for **security zones** — named bands of the estate with
different enforcement rigidity, and the lifecycle of time-boxed exceptions to
them.

A zone answers a question no existing axis answers: *is this control enforced
here, and what happens when it fails?* NetKingdom can already say how exposed a
workload is (environment posture), how ready it is (workload maturity `M0`–`M3`),
and what state the organization is in (`organization_posture`). All three
describe. None decides.

`zone-engine` is **not** a policy decision point. `flex-auth` remains the only
PDP; zone membership reaches it by compilation into the registry it already
consumes, never by a synchronous lookup in the decision path.

Orient: `GOAL.md` → `SCOPE.md` → `workplans/`.