Inventory quartet and initial leases

20-identity/roles/operator.md

@@ -0,0 +1,20 @@
+# Role: operator
+
+## Purpose
+
+Execute critical operational actions from the core boundary.
+
+## Scope
+
+- Allowed: provisioning, configuration, recovery, decommission.
+- Forbidden: ad-hoc changes outside `op-core-vm`.
+
+## Allowed origins
+
+- `op-core-vm` only.
+
+## Rotation / revocation
+
+- Revoke: invalidate leases, rotate credentials, and sever device trust.
+- Prove: record the action in `70-audits/reports/`.
+

20-identity/roles/witness.md

@@ -0,0 +1,20 @@
+# Role: witness
+
+## Purpose
+
+Observe and confirm (alerts, read-only checks, second-factor confirmations).
+
+## Scope
+
+- Allowed: read-only verification and confirmations.
+- Forbidden: provisioning and configuration changes.
+
+## Allowed origins
+
+- `op-witness-phone` only.
+
+## Rotation / revocation
+
+- Revoke: remove device access and rotate any linked factors.
+- Prove: record the action in `70-audits/reports/`.
+