Trusted context constraints
Trusted context is information a product obtains from a verified credential, reviewed configuration, or its own governed state. A caller-supplied field is not trusted merely because it has a familiar name.
Registry Evidence
Section titled “Registry Evidence”Registry Evidence authenticates the caller and matches one complete entitlement before source access. Requirement, purpose, audience, source request, derivation, and output form come from the reviewed bundle. The caller selects only values the request contract explicitly permits.
Base Registry Engine
Section titled “Base Registry Engine”Base Registry Engine (BReg) applies the same rule to governed record operations.
BReg access profiles bind allowed operations, fields, row constraints, purposes, and claims to the verified caller and compiled registry model. The runtime does not treat an arbitrary request field as an authorization decision.
Operator boundary
Section titled “Operator boundary”The identity provider remains responsible for credential issuance and claim accuracy. The operator owns configuration approval, secret custody, network policy, and recovery. Product checks prove contract consistency, not institutional authority.