Portable identity boundary
Identity evidence
Identity can help establish who is participating. It does not answer what that participant is allowed to do.
separate
Identity
Who or what appears to control an identifier or credential.
separate
Mandate
What authority a participant has been granted for a specific purpose and time.
separate
Capability
What operations a participant or service is technically able to perform.
separate
Permission
What Machine Realms or another realm actually authorizes in context.
No external verifier is enabled yet.
Portable third-party identity remains a future evidence input and will not be treated as automatic trust.