Inventory quartet and initial leases

2025-12-17 15:54:20 +00:00
parent 44edf6734b
commit 901444a6d5
21 changed files with 291 additions and 0 deletions
--- a/20-identity/roles/witness.md
+++ b/20-identity/roles/witness.md
@@ -0,0 +1,20 @@
+# Role: witness
+
+## Purpose
+
+Observe and confirm (alerts, read-only checks, second-factor confirmations).
+
+## Scope
+
+- Allowed: read-only verification and confirmations.
+- Forbidden: provisioning and configuration changes.
+
+## Allowed origins
+
+- `op-witness-phone` only.
+
+## Rotation / revocation
+
+- Revoke: remove device access and rotate any linked factors.
+- Prove: record the action in `70-audits/reports/`.
+