Actor boundaries
Who is responsible at each moment of a shared-record write. This is the workflow view of the Access model.
Roles at write time
| Role | Owns | Does not own |
|---|---|---|
| Operator | Entitlement, install, credential minting | Model prompts, generative UX |
| Agent / integrator | Tool calls under packs | Final write signature |
| External signer | Final signature after prepare | Running the MCP server |
| Legate | Credential check, pack exposure, prepare/submit interfaces | Judgment, scoring, policy source |
| Agent host | Private generation | Long-lived write keys, product judgment |
Boundary rules
- Agents prepare. Humans or dedicated signers conclude.
- Capability packs bound what tools exist for a credential. Naming a write tool does not grant a write pack.
- The agent host is out of the Legate contract. Leaving lasting commit power there breaks the control story.
- Arbiter assessor evidence, when entitled, hangs off the shared-record path. It does not replace the external signer.