Agentic Covenants / Agentic Inventory Matrix

Authorization at Operator-declared

This layer is deterministic-when-invoked.

Operator records authorized scope in registry, linked to RBAC manifest paths and IAM policy ARNs.