diff --git a/README.md b/README.md
index 767f6a98..a334592e 100644
--- a/README.md
+++ b/README.md
@@ -784,15 +784,22 @@ the suite, and by any module deciding which of its own resources a caller sees.
 The authority knows resources by id only; each module maps ids onto its own.
 
 On the local authority a role's scope may carry `resources`. A scope with
-none covers the whole kind. A person's answer is what her roles grant. A
-module's or an installation's own work is bounded by its capability alone. A
-capability narrowed to named ids covers only the ones the owner's grants also
-cover. A capability that does not hold the action is refused.
+none covers the whole kind. A scope with resources is never issued as the
+whole kind (2026-10-26): its ids are the capability's resource ids, so an ask
+naming none is issued on exactly those ids, and an ask naming any other id, or
+the whole kind, is refused, at the root and at every hop. A token cannot carry
+a prefix or a pattern, so one holds only the ids an ask (or the capability a
+hop derives from) names that it matches, and an ask naming none carries none
+of it. A person's answer is what her roles grant, cut to the ids her
+capability names. A module's or an installation's own work is bounded by its
+capability alone. A capability that does not hold the action is refused.
 
 The suite line "the authority answers which resources a context covers, by
 grant" holds an implementation to a fixture's covered and uncovered ids, an
-unheld action, and a narrowed capability. It fails on an implementation that
-answers every resource.
+unheld action, an empty ask that never carries the whole kind, and the refusal
+of an ask naming an uncovered id or the whole kind. It fails on an
+implementation that answers every resource or issues a resource-scoped role as
+the whole kind.
 
 Building it exposed an attenuation bug: the local authority's scope operations dropped
 resource ids, so a capability asked for two named resources was issued for the
diff --git a/libraries/authority-core/go/authority/attachment.go b/libraries/authority-core/go/authority/attachment.go
index 5663e01f..291bea67 100644
--- a/libraries/authority-core/go/authority/attachment.go
+++ b/libraries/authority-core/go/authority/attachment.go
@@ -96,7 +96,8 @@ func (s *Service) AttachResource(ctx context.Context, r AttachmentRequest) (stri
 			return err
 		}
 		owner = inst.ID
-		return nil
+		return s.journal(ctx, tx, domain.Event{Kind: domain.ResourceAttached, Organization: inst.Organization, Actor: r.Store.Module, Subject: inst.ID,
+			Detail: map[string]string{"kind": r.Kind, "resource": r.ResourceID}})
 	})
 	return owner, err
 }
@@ -136,7 +137,8 @@ func (s *Service) DetachResource(ctx context.Context, caller Workload, org, kind
 				return err
 			}
 			owner = inst.ID
-			return nil
+			return s.journal(ctx, tx, domain.Event{Kind: domain.ResourceDetached, Organization: org, Actor: caller.Module, Subject: inst.ID,
+				Detail: map[string]string{"kind": kind, "resource": id}})
 		}
 		return nil
 	})
diff --git a/libraries/authority-core/go/authority/check.go b/libraries/authority-core/go/authority/check.go
index 087b1de1..69b72ff3 100644
--- a/libraries/authority-core/go/authority/check.go
+++ b/libraries/authority-core/go/authority/check.go
@@ -52,6 +52,36 @@ func (s *Service) Check(ctx context.Context, token, audience string) (*workconte
 	return verified, revision, nil
 }
 
+// CheckMethod is Check, then what the audience module's delivery declares
+// for method applied to what the call's current actor holds (the last hop's
+// grant, never the owner's authority above it): decide.AdmitMethod. An empty
+// method is Check alone. Advisory decides the method but does not enforce it:
+// a sound capability is answered with the method's refusal beside it, the
+// same refusal a check that enforces it returns as its error.
+func (s *Service) CheckMethod(ctx context.Context, token, audience, method string, advisory bool) (verified *workcontext.Verified, revision uint64, refusal error, err error) {
+	if audience == "" {
+		return nil, 0, nil, domain.Refuse("a check names the audience the caller is")
+	}
+	if verified, revision, err = s.Check(ctx, token, audience); err != nil || method == "" {
+		return verified, revision, nil, err
+	}
+	err = s.store.Read(ctx, func(tx Tx) error {
+		m, err := tx.Module(audience)
+		if err != nil {
+			return notFound(err)
+		}
+		refusal = decide.AdmitMethod(m, method, verified.EffectiveScopes())
+		return nil
+	})
+	if err != nil {
+		return nil, 0, nil, err
+	}
+	if refusal != nil && !advisory {
+		return nil, 0, nil, refusal
+	}
+	return verified, revision, refusal, nil
+}
+
 // Grant is one way a capability covers resources of a kind: a resource match
 // and, when set, the owner the resource must have.
 type Grant struct {
@@ -81,7 +111,7 @@ func (s *Service) ListResources(ctx context.Context, token, audience, kind, acti
 	err = s.store.Read(ctx, func(tx Tx) error {
 		rows := effective
 		if wc.GetOwnerPrincipalKind() == "human" {
-			p, err := tx.Person(wc.GetOwnerPrincipalId())
+			p, err := tx.Member(wc.GetTenantId(), wc.GetOwnerPrincipalId())
 			if err != nil {
 				return domain.Refuse("the owner %s is no longer a member", wc.GetOwnerPrincipalId())
 			}
diff --git a/libraries/authority-core/go/authority/consent.go b/libraries/authority-core/go/authority/consent.go
index 5c260599..17ba5877 100644
--- a/libraries/authority-core/go/authority/consent.go
+++ b/libraries/authority-core/go/authority/consent.go
@@ -13,16 +13,28 @@ import (
 )
 
 func administrator(tx Tx, caller Person, org string) error {
-	p, err := tx.Person(caller.ID)
+	p, err := memberAs(tx, caller, org)
 	if err != nil && !errors.Is(err, domain.ErrNotFound) {
 		return err
 	}
-	if caller.ID == "" || err != nil || p.Organization != org || !decide.IsAdministrator(p) {
+	if err != nil || !decide.IsAdministrator(p) {
 		return domain.Refuse("installation administration requires an administrator or owner of organization %q", org)
 	}
 	return nil
 }
 
+// memberAs is the caller as a member of org, read now. The caller acts in the
+// organization their session was opened at: a person who belongs to several
+// organizations administers or reads another one only from a session there,
+// so a session never carries one organization's authority into another.
+// Anything else is ErrNotFound, as an absent member is.
+func memberAs(tx Tx, caller Person, org string) (domain.Person, error) {
+	if caller.ID == "" || org == "" || caller.Organization != org {
+		return domain.Person{}, fmt.Errorf("%q acting at %q: %w", caller.ID, org, domain.ErrNotFound)
+	}
+	return tx.Member(org, caller.ID)
+}
+
 // offerDigest covers every authority declaration in the reviewed module. JSON
 // sorts map keys; the receipt therefore covers roles, ceilings and bindings too.
 func offerDigest(m domain.Module) (string, error) {
diff --git a/libraries/authority-core/go/authority/current_test.go b/libraries/authority-core/go/authority/current_test.go
index 1dcf7676..ee107a37 100644
--- a/libraries/authority-core/go/authority/current_test.go
+++ b/libraries/authority-core/go/authority/current_test.go
@@ -10,7 +10,8 @@ import (
 
 func TestCurrentInstallationIsConfinedToTheAuthenticatedAudience(t *testing.T) {
 	h := newHarness(t)
-	parent := h.must(h.root("rob", "store", sc(kind, "read")))
+	// rob and omar read store-x alone: each asks for what they hold.
+	parent := h.must(h.root("rob", "store", owned(kind, "", []string{"read"}, "store-x")))
 	inst, err := h.svc.CurrentInstallation(h.ctx, parent.Token, authority.Workload{Module: "store"})
 	if err != nil || inst.ID != authority.StableInstallationID(acme, "store") || inst.Organization != acme || inst.Target != "store" {
 		t.Fatalf("current installation: %+v %v", inst, err)
@@ -25,7 +26,7 @@ func TestCurrentInstallationIsConfinedToTheAuthenticatedAudience(t *testing.T) {
 	}
 	h.store.PutPerson(domain.Person{ID: "omar", Organization: globex, Roles: []string{"store-reader"}})
 	h.store.PutOrgRole(domain.OrgRole{Organization: globex, Name: "store-reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}, Resources: []resources.Grant{{ID: "store-x"}}}}})
-	foreign := h.must(h.root("omar", "store", sc(kind, "read")))
+	foreign := h.must(h.root("omar", "store", owned(kind, "", []string{"read"}, "store-x")))
 	other, err := h.svc.CurrentInstallation(h.ctx, foreign.Token, authority.Workload{Module: "store"})
 	if err != nil || other.Organization != globex || other.ID == inst.ID {
 		t.Fatalf("tenant isolation: %+v %v", other, err)
diff --git a/libraries/authority-core/go/authority/delegation.go b/libraries/authority-core/go/authority/delegation.go
index e737cdfa..72888bde 100644
--- a/libraries/authority-core/go/authority/delegation.go
+++ b/libraries/authority-core/go/authority/delegation.go
@@ -2,6 +2,7 @@ package authority
 
 import (
 	"context"
+	"errors"
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
@@ -15,7 +16,7 @@ import (
 func (s *Service) Delegate(ctx context.Context, who Person, module string, scopes Scopes, purpose string) (domain.Delegation, error) {
 	var d domain.Delegation
 	err := s.store.Write(ctx, func(tx Tx) error {
-		p, err := tx.Person(who.ID)
+		p, err := tx.Member(who.Organization, who.ID)
 		if err != nil {
 			return notFound(err)
 		}
@@ -26,7 +27,15 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 		if len(scopes) == 0 {
 			return domain.Refuse("a delegation names what it grants")
 		}
-		holdings, err := held(tx, p, m)
+		if len(purpose) > MaxDelegationPurpose {
+			return domain.Malformed("a delegation's purpose is at most %d characters, not %d", MaxDelegationPurpose, len(purpose))
+		}
+		// A module not installed at the grantor's organization could never
+		// issue from the delegation: it is refused rather than recorded.
+		if inst, err := installationOf(tx, p.Organization, m.Name); err != nil || inst.Status != domain.Active {
+			return domain.NotNow("module %q is not installed in organization %s, so nothing could issue from a delegation to it", m.Name, p.Organization)
+		}
+		holdings, err := held(tx, p, m, scopes)
 		if err != nil {
 			return err
 		}
@@ -35,12 +44,12 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 			if err != nil {
 				continue
 			}
-			there, _, _, err := throughSolutions(tx, p, target, []string{m.Principal})
+			there, _, _, err := throughSolutions(tx, p, target, []string{m.Principal}, scopes)
 			if err != nil {
 				return err
 			}
 			if m.Kind != domain.KindSolution {
-				if there, err = held(tx, p, target); err != nil {
+				if there, err = held(tx, p, target, scopes); err != nil {
 					return err
 				}
 			}
@@ -51,13 +60,21 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 			return domain.Refuse("%s delegates what they do not hold", p.ID)
 		}
 		d = domain.Delegation{ID: s.cfg.NewID(), Organization: p.Organization, Grantor: p.ID, Module: m.Name, Purpose: purpose, Scopes: scope.Normalize(scopes)}
-		return tx.PutDelegation(d)
+		if err := tx.PutDelegation(d); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, domain.Event{Kind: domain.DelegationGranted, Organization: d.Organization, Actor: d.Grantor, Subject: d.ID,
+			Detail: map[string]string{"module": d.Module, "purpose": d.Purpose}})
 	})
 	return d, err
 }
 
-// RevokeDelegation ends a delegation; only its grantor may. Its capabilities
-// are refused at once.
+// MaxDelegationPurpose bounds the purpose a delegation records.
+const MaxDelegationPurpose = 1024
+
+// RevokeDelegation ends a delegation: its grantor may, and so may an
+// administrator of its organization acting there. Anyone else learns nothing,
+// not even that it exists. Its capabilities are refused at once.
 func (s *Service) RevokeDelegation(ctx context.Context, who Person, id string) (domain.Delegation, error) {
 	var d domain.Delegation
 	err := s.store.Write(ctx, func(tx Tx) error {
@@ -66,7 +83,13 @@ func (s *Service) RevokeDelegation(ctx context.Context, who Person, id string) (
 			return notFound(err)
 		}
 		if d.Grantor != who.ID {
-			return domain.Refuse("only the grantor of %s may revoke it", id)
+			admin, err := memberAs(tx, who, d.Organization)
+			if err != nil && !errors.Is(err, domain.ErrNotFound) {
+				return err
+			}
+			if err != nil || !decide.IsAdministrator(admin) {
+				return domain.Missing("delegation %q", id)
+			}
 		}
 		if d.Revoked {
 			return nil
@@ -75,7 +98,11 @@ func (s *Service) RevokeDelegation(ctx context.Context, who Person, id string) (
 		if err := tx.PutDelegation(d); err != nil {
 			return err
 		}
-		return tx.BumpAuthorizationRevision(d.Organization)
+		if err := tx.BumpAuthorizationRevision(d.Organization); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, domain.Event{Kind: domain.DelegationRevoked, Organization: d.Organization, Actor: who.ID, Subject: d.ID,
+			Detail: map[string]string{"module": d.Module}})
 	})
 	return d, err
 }
@@ -138,11 +165,11 @@ func (s *Service) IssueForDelegation(ctx context.Context, id string, actor Workl
 		if through, err = decide.ScopesFor(binding, r.Operation, "invoke"); err != nil {
 			return err
 		}
-		p, err := tx.Person(d.Grantor)
+		p, err := tx.Member(d.Organization, d.Grantor)
 		if err != nil {
 			return domain.Refuse("the grantor %s is no longer a member", d.Grantor)
 		}
-		h, _, _, err := throughSolutions(tx, p, audience, []string{am.Principal})
+		h, _, _, err := throughSolutions(tx, p, audience, []string{am.Principal}, d.Scopes)
 		if err != nil {
 			return err
 		}
diff --git a/libraries/authority-core/go/authority/delegation_rules_test.go b/libraries/authority-core/go/authority/delegation_rules_test.go
new file mode 100644
index 00000000..7ec67454
--- /dev/null
+++ b/libraries/authority-core/go/authority/delegation_rules_test.go
@@ -0,0 +1,68 @@
+package authority_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// A delegation is to a module installed at the grantor's organization, with a
+// bounded purpose; its grantor or an administrator of its organization ends
+// it, and anyone else learns nothing of it.
+func TestDelegationRules(t *testing.T) {
+	h := newHarness(t)
+	read := []*basev0.WorkScopeV1{sc(kind, "read")}
+	rob := h.person("rob")
+
+	t.Run("a purpose past its bound is malformed", func(t *testing.T) {
+		_, err := h.svc.Delegate(h.ctx, rob, "store", read, strings.Repeat("p", authority.MaxDelegationPurpose+1))
+		code(t, err, domain.Invalid)
+	})
+	t.Run("a module not installed at the grantor's organization is refused", func(t *testing.T) {
+		if err := h.svc.UninstallAsHost(h.ctx, acme, authority.StableInstallationID(acme, "store")); err != nil {
+			t.Fatal(err)
+		}
+		_, err := h.svc.Delegate(h.ctx, rob, "store", read, "a job")
+		code(t, err, domain.Precondition)
+		refused(t, err, "is not installed")
+	})
+}
+
+func TestADelegationIsEndedByItsGrantorOrAnAdministratorAlone(t *testing.T) {
+	h := newHarness(t)
+	// Rob reads store-x alone: he delegates that, never the whole kind.
+	read := []*basev0.WorkScopeV1{owned(kind, "", []string{"read"}, "store-x")}
+	rob, maya, alex, zoe := h.person("rob"), h.person("maya"), h.person("alex"), h.person("zoe")
+	for _, tc := range []struct {
+		name   string
+		who    authority.Person
+		ok     bool
+		reason domain.Code
+	}{
+		{"another member", maya, false, domain.NotFound},
+		{"another organization's administrator", zoe, false, domain.NotFound},
+		{"an administrator of its organization", alex, true, 0},
+		{"its grantor", rob, true, 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			d, err := h.svc.Delegate(h.ctx, rob, "store", read, "a job")
+			if err != nil {
+				t.Fatal(err)
+			}
+			ended, err := h.svc.RevokeDelegation(h.ctx, tc.who, d.ID)
+			if !tc.ok {
+				code(t, err, tc.reason)
+				return
+			}
+			if err != nil || !ended.Revoked {
+				t.Fatalf("revoked %+v %v", ended, err)
+			}
+			if again, err := h.svc.RevokeDelegation(h.ctx, tc.who, d.ID); err != nil || !again.Revoked {
+				t.Fatalf("revoking twice answers the delegation as it stands: %+v %v", again, err)
+			}
+		})
+	}
+}
diff --git a/libraries/authority-core/go/authority/host_installs_modules_test.go b/libraries/authority-core/go/authority/host_installs_modules_test.go
new file mode 100644
index 00000000..25ccd114
--- /dev/null
+++ b/libraries/authority-core/go/authority/host_installs_modules_test.go
@@ -0,0 +1,185 @@
+package authority_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/memstore"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// hostInstalled is a core whose host decides which organizations hold each
+// module (Config.HostInstallsModules): its store answers the host's own
+// records, which a test writes as the host would.
+type hostInstalled struct {
+	*harness
+	svc   *authority.Service
+	store *memstore.Store
+}
+
+func newHostInstalled(t *testing.T) *hostInstalled {
+	t.Helper()
+	h := newHarness(t)
+	cfg := h.cfg
+	cfg.HostInstallsModules = true
+	store := memstore.New()
+	svc, err := authority.New(store, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, org := range []string{acme, globex} {
+		store.PutOrganization(domain.Organization{ID: org, Name: org})
+	}
+	store.PutOrgRole(domain.OrgRole{Organization: acme, Name: "admin"})
+	store.PutPerson(domain.Person{ID: "alex", Organization: acme, Roles: []string{"admin"}})
+	if _, err := svc.ApplyModule(h.ctx, domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 1,
+		ResourceKinds: []*basev0.WorkScopeV1{sc(kind, "read", "write")},
+		Bindings: map[string]domain.Binding{"self": {ID: "self", Audience: "store",
+			InvokeScopes: []*basev0.WorkScopeV1{sc(kind, "read", "write")}, HeadlessScopes: []*basev0.WorkScopeV1{sc(kind, "read")}}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return &hostInstalled{harness: h, svc: svc, store: store}
+}
+
+// record writes the host's own installation record of the store module.
+func (h *hostInstalled) record(org, id string, status domain.Status, revision uint64) {
+	h.t.Helper()
+	if err := h.store.Write(h.ctx, func(tx authority.Tx) error {
+		return tx.PutInstallation(domain.Installation{ID: id, Organization: org, Target: "store", Status: status, Revision: revision})
+	}); err != nil {
+		h.t.Fatal(err)
+	}
+}
+
+func (h *hostInstalled) issue(w authority.Workload, org string) (authority.Issued, error) {
+	return h.svc.IssueForWorkload(h.ctx, w, authority.IssueRequest{Binding: "self", Organization: org})
+}
+
+func (h *hostInstalled) installations() []domain.Installation {
+	h.t.Helper()
+	var all []domain.Installation
+	if err := h.store.Read(h.ctx, func(tx authority.Tx) error {
+		var err error
+		all, err = tx.Installations("")
+		return err
+	}); err != nil {
+		h.t.Fatal(err)
+	}
+	return all
+}
+
+// The core installs no module by itself: not at delivery, not for a new
+// organization, not when reconciling; and the host's record is never retired
+// by the core, by withdrawal or by host setup.
+func TestAHostThatInstallsModulesIsTheOnlyOneThatDoes(t *testing.T) {
+	h := newHostInstalled(t)
+	if all := h.installations(); len(all) != 0 {
+		t.Fatalf("delivery installed %v", all)
+	}
+	ids, err := h.svc.OrganizationAdded(h.ctx, acme)
+	if err != nil || len(ids) != 0 {
+		t.Fatalf("a new organization was given %v (%v)", ids, err)
+	}
+	if err := h.svc.ReconcileOrganizations(h.ctx); err != nil {
+		t.Fatal(err)
+	}
+	if all := h.installations(); len(all) != 0 {
+		t.Fatalf("reconciling installed %v", all)
+	}
+	_, err = h.svc.OrganizationAdded(h.ctx, "nobody")
+	code(t, err, domain.NotFound)
+
+	h.record(acme, "host-1", domain.Active, 1)
+	// A redelivery that narrows the module raises the host's record's
+	// revision, so what was issued under the wider module ends.
+	if _, err := h.svc.ApplyModule(h.ctx, domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 2,
+		ResourceKinds: []*basev0.WorkScopeV1{sc(kind, "read")},
+		Bindings: map[string]domain.Binding{"self": {ID: "self", Audience: "store",
+			InvokeScopes: []*basev0.WorkScopeV1{sc(kind, "read")}, HeadlessScopes: []*basev0.WorkScopeV1{sc(kind, "read")}}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if all := h.installations(); len(all) != 1 || all[0].Revision != 2 || all[0].Status != domain.Active {
+		t.Fatalf("a narrowing left the host's record at %v", all)
+	}
+	err = h.svc.UninstallAsHost(h.ctx, acme, "host-1")
+	code(t, err, domain.Denied)
+	if err := h.svc.WithdrawModule(h.ctx, "store"); err != nil {
+		t.Fatal(err)
+	}
+	all := h.installations()
+	if len(all) != 1 || all[0].Status != domain.Active || all[0].Revision != 2 {
+		t.Fatalf("the host's record moved: %v", all)
+	}
+}
+
+// A workload is issued only where its host recorded an installation, never
+// past the organization its credential is bound to, and nothing once the host
+// retires the installation: its capabilities fail their next check.
+func TestAWorkloadIsIssuedOnlyWhereItsHostInstalledIt(t *testing.T) {
+	store := authority.Workload{Module: "store"}
+	for _, tc := range []struct {
+		name   string
+		setup  func(h *hostInstalled)
+		w      authority.Workload
+		org    string
+		want   domain.Code
+		issued bool
+	}{
+		{name: "no installation anywhere", w: store, org: acme, want: domain.Precondition},
+		{name: "no installation and no organization named", w: store, want: domain.Denied},
+		{name: "installed elsewhere", setup: func(h *hostInstalled) { h.record(globex, "host-g", domain.Active, 1) }, w: store, org: acme, want: domain.Precondition},
+		{name: "installed here", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) }, w: store, org: acme, issued: true},
+		{name: "the only installation, no organization named", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) }, w: store, issued: true},
+		{name: "retired by the host", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Revoked, 2) }, w: store, org: acme, want: domain.Precondition},
+		{name: "bound to another organization", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) },
+			w: authority.Workload{Module: "store", Organization: globex}, org: acme, want: domain.Denied},
+		{name: "bound here, organization implied", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) },
+			w: authority.Workload{Module: "store", Organization: acme}, issued: true},
+		{name: "bound to an organization that has no installation", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) },
+			w: authority.Workload{Module: "store", Organization: globex}, want: domain.Precondition},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			h := newHostInstalled(t)
+			if tc.setup != nil {
+				tc.setup(h)
+			}
+			issued, err := h.issue(tc.w, tc.org)
+			if !tc.issued {
+				code(t, err, tc.want)
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := issued.Context.GetTenantId(); got != acme {
+				t.Fatalf("issued at %q", got)
+			}
+			if _, _, err := h.svc.Check(h.ctx, issued.Token, "store"); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+
+	t.Run("a capability ends when the host retires the installation, and stays ended after a reinstall", func(t *testing.T) {
+		h := newHostInstalled(t)
+		h.record(acme, "host-1", domain.Active, 1)
+		issued, err := h.issue(store, acme)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h.record(acme, "host-1", domain.Revoked, 2)
+		if _, _, err := h.svc.Check(h.ctx, issued.Token, "store"); err == nil {
+			t.Fatal("a capability survived its installation's retirement")
+		}
+		h.record(acme, "host-2", domain.Active, 1)
+		if _, _, err := h.svc.Check(h.ctx, issued.Token, "store"); err == nil {
+			t.Fatal("a reinstall revived a capability sealed to the retired installation")
+		}
+		if _, err := h.issue(store, acme); err != nil {
+			t.Fatal(err)
+		}
+	})
+}
diff --git a/libraries/authority-core/go/authority/issue.go b/libraries/authority-core/go/authority/issue.go
index 4adde2a2..d96bbab6 100644
--- a/libraries/authority-core/go/authority/issue.go
+++ b/libraries/authority-core/go/authority/issue.go
@@ -32,8 +32,9 @@ type Issued struct {
 
 // held is what a person holds at an audience: at a solution, the scopes of the
 // roles granted them on its installation, owned by its principal; at a
-// module, their organization roles within what it serves.
-func held(tx Tx, p domain.Person, audience domain.Module) (Scopes, error) {
+// module, their organization roles within what it serves, resource-scoped
+// roles holding the ids their matchers select of named (decide.OrgScopes).
+func held(tx Tx, p domain.Person, audience domain.Module, named Scopes) (Scopes, error) {
 	if audience.Kind == domain.KindSolution {
 		inst, err := installationOf(tx, p.Organization, audience.Name)
 		if errors.Is(err, domain.ErrNotFound) {
@@ -56,7 +57,7 @@ func held(tx Tx, p domain.Person, audience domain.Module) (Scopes, error) {
 	if err != nil {
 		return nil, err
 	}
-	return decide.OrgScopes(roles, audience), nil
+	return decide.OrgScopes(roles, audience, named), nil
 }
 
 // solutionCeiling intersects the current roles of each solution the verified
@@ -101,18 +102,18 @@ func solutionCeiling(tx Tx, p domain.Person, principals []string) (ceiling Scope
 // throughSolutions is what a person holds at audience on a path through
 // principals: the solutions' roles alone when a solution is on the path
 // (confined to its principal's data), the person's own grants otherwise.
-func throughSolutions(tx Tx, p domain.Person, audience domain.Module, principals []string) (h, ceiling Scopes, bounded bool, err error) {
+func throughSolutions(tx Tx, p domain.Person, audience domain.Module, principals []string, named Scopes) (h, ceiling Scopes, bounded bool, err error) {
 	if ceiling, bounded, err = solutionCeiling(tx, p, principals); err != nil {
 		return
 	}
 	if !bounded {
-		h, err = held(tx, p, audience)
+		h, err = held(tx, p, audience, named)
 		return
 	}
 	h = scope.Intersect(ceiling, audience.ResourceKinds)
 	if audience.Kind == domain.KindSolution {
 		var target Scopes
-		if target, err = held(tx, p, audience); err != nil {
+		if target, err = held(tx, p, audience, named); err != nil {
 			return
 		}
 		h = scope.Intersect(h, target)
@@ -120,6 +121,16 @@ func throughSolutions(tx Tx, p domain.Person, audience domain.Module, principals
 	return
 }
 
+// namedBy is what a hop decides about: its ask and every scope its parent
+// carries, so a prefix or a pattern holds the ids the parent was issued on.
+func namedBy(asked Scopes, parent *basev0.WorkContextV1) Scopes {
+	named := append(slices.Clone(asked), parent.GetAuthorityScopes()...)
+	for _, actor := range parent.GetActorChain() {
+		named = append(named, actor.GetGrantedScopes()...)
+	}
+	return named
+}
+
 // solutionPrincipals are the current actor and the services of a verified chain.
 func solutionPrincipals(wc *basev0.WorkContextV1, current string) []string {
 	out := []string{current}
@@ -181,7 +192,7 @@ func (s *Service) IssueForPerson(ctx context.Context, who Person, r IssueRequest
 		if audience, err = tx.Module(r.Audience); err != nil {
 			return notFound(err)
 		}
-		p, err := tx.Person(who.ID)
+		p, err := tx.Member(who.Organization, who.ID)
 		if err != nil || p.Organization != who.Organization {
 			return domain.Refuse("the session's person is no longer a member of %s", who.Organization)
 		}
@@ -192,7 +203,7 @@ func (s *Service) IssueForPerson(ctx context.Context, who Person, r IssueRequest
 		if f, err = s.src.fenceIn(tx, p.Organization, p.ID, inst.ID); err != nil {
 			return err
 		}
-		if heldHere, err = held(tx, p, audience); err != nil {
+		if heldHere, err = held(tx, p, audience, r.Scopes); err != nil {
 			return err
 		}
 		if audience.Kind == domain.KindSolution && !audience.OwnerAware {
@@ -210,7 +221,7 @@ func (s *Service) IssueForPerson(ctx context.Context, who Person, r IssueRequest
 			if err != nil {
 				return notFound(err)
 			}
-			there, _, _, err := throughSolutions(tx, p, target, []string{audience.Principal})
+			there, _, _, err := throughSolutions(tx, p, target, []string{audience.Principal}, r.Scopes)
 			if err != nil {
 				return err
 			}
@@ -257,6 +268,13 @@ func (s *Service) IssueForWorkload(ctx context.Context, w Workload, r IssueReque
 			return notFound(err)
 		}
 		org = r.Organization
+		if w.Organization != "" {
+			// A credential bound to one organization acts there and nowhere else.
+			if org != "" && org != w.Organization {
+				return domain.Refuse("workload %s is bound to organization %s; it is issued nothing at %s", w.Module, w.Organization, org)
+			}
+			org = w.Organization
+		}
 		if org == "" {
 			var orgs []string
 			all, err := tx.Installations("")
@@ -291,7 +309,7 @@ func (s *Service) IssueForWorkload(ctx context.Context, w Workload, r IssueReque
 			return err
 		}
 		inst, err := installationOf(tx, org, module.Name)
-		if err != nil {
+		if err != nil || inst.Status != domain.Active {
 			return domain.NotNow("%s is not installed at %s", module.Name, org)
 		}
 		instID = inst.ID
@@ -475,11 +493,11 @@ func (s *Service) IssueChild(ctx context.Context, parent string, actor Workload,
 		bounded := false
 		switch claims.GetOwnerPrincipalKind() {
 		case "human":
-			p, err := tx.Person(claims.GetOwnerPrincipalId())
+			p, err := tx.Member(tenant, claims.GetOwnerPrincipalId())
 			if err != nil {
 				return domain.Refuse("the owner %s is no longer a member", claims.GetOwnerPrincipalId())
 			}
-			if heldHere, sourceCeiling, bounded, err = throughSolutions(tx, p, audience, solutionPrincipals(claims, am.Principal)); err != nil {
+			if heldHere, sourceCeiling, bounded, err = throughSolutions(tx, p, audience, solutionPrincipals(claims, am.Principal), namedBy(r.Scopes, claims)); err != nil {
 				return err
 			}
 		case "agent":
diff --git a/libraries/authority-core/go/authority/journal_test.go b/libraries/authority-core/go/authority/journal_test.go
new file mode 100644
index 00000000..ac9272e7
--- /dev/null
+++ b/libraries/authority-core/go/authority/journal_test.go
@@ -0,0 +1,97 @@
+package authority_test
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// Every change of authority is journaled in the transaction that makes it,
+// naming where it happened, who acted and what changed; a journal that
+// refuses aborts the change.
+func TestEveryChangeIsJournaledInItsOwnTransaction(t *testing.T) {
+	h := newHarness(t)
+	var events []domain.Event
+	refuse := false
+	cfg := h.cfg
+	cfg.Journal = func(_ context.Context, _ authority.Tx, e domain.Event) error {
+		if refuse {
+			return errors.New("the journal is unavailable")
+		}
+		events = append(events, e)
+		return nil
+	}
+	svc, err := authority.New(h.store, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	alex := h.person("alex")
+	inst := h.inst(acme, "a").ID
+	viewer := authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "maya"}
+	steps := []struct {
+		name string
+		do   func() error
+		want domain.Event
+	}{
+		{"a role granted", func() error { _, err := svc.GrantRole(h.ctx, alex, viewer); return err },
+			domain.Event{Kind: domain.RoleGranted, Organization: acme, Actor: "alex", Subject: inst}},
+		{"a role revoked", func() error { _, err := svc.RevokeRole(h.ctx, alex, viewer); return err },
+			domain.Event{Kind: domain.RoleRevoked, Organization: acme, Actor: "alex", Subject: inst}},
+		{"a delegation granted", func() error {
+			_, err := svc.Delegate(h.ctx, h.person("rob"), "store", []*basev0.WorkScopeV1{owned(kind, "", []string{"read"}, "store-x")}, "a purpose")
+			return err
+		}, domain.Event{Kind: domain.DelegationGranted, Organization: acme, Actor: "rob"}},
+		{"an installation uninstalled", func() error { return svc.Uninstall(h.ctx, alex, acme, inst) },
+			domain.Event{Kind: domain.InstallationUninstalled, Organization: acme, Actor: "alex", Subject: inst}},
+		{"an installation requested and activated", func() error {
+			_, err := svc.Install(h.ctx, alex, acme, "a", "author", "alex", h.approval(acme, "a"), nil)
+			return err
+		}, domain.Event{Kind: domain.InstallationActivated, Organization: acme, Actor: "alex", Subject: inst}},
+		{"a module applied", func() error {
+			m := solution("d", true)
+			_, err := svc.ApplyModule(h.ctx, m)
+			return err
+		}, domain.Event{Kind: domain.ModuleApplied, Subject: "d"}},
+		{"a module withdrawn", func() error { return svc.WithdrawModule(h.ctx, "d") }, domain.Event{Kind: domain.ModuleWithdrawn, Subject: "d"}},
+	}
+	for _, step := range steps {
+		t.Run(step.name, func(t *testing.T) {
+			before := len(events)
+			if err := step.do(); err != nil {
+				t.Fatal(err)
+			}
+			if len(events) == before {
+				t.Fatal("nothing was journaled")
+			}
+			got := events[len(events)-1]
+			if got.Kind != step.want.Kind || got.Organization != step.want.Organization || got.Actor != step.want.Actor ||
+				(step.want.Subject != "" && got.Subject != step.want.Subject) {
+				t.Fatalf("journaled %+v, want %+v", got, step.want)
+			}
+		})
+	}
+	if !slices.ContainsFunc(events, func(e domain.Event) bool { return e.Kind == domain.InstallationRequested }) {
+		t.Fatal("the pending attempt was not journaled")
+	}
+
+	t.Run("a journal that refuses aborts the change", func(t *testing.T) {
+		refuse = true
+		defer func() { refuse = false }()
+		_, err := svc.GrantRole(h.ctx, alex, authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "remi"})
+		if err == nil {
+			t.Fatal("the grant committed without its journal entry")
+		}
+		grants, err := h.svc.ListRoleGrants(h.ctx, alex, acme, inst)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if slices.ContainsFunc(grants, func(g domain.RoleGrant) bool { return g.PersonID == "remi" }) {
+			t.Fatal("the refused journal left the grant behind")
+		}
+	})
+}
diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index 91457e4c..310edf3f 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -3,6 +3,7 @@ package authority
 import (
 	"context"
 	"errors"
+	"fmt"
 	"maps"
 	"slices"
 
@@ -12,13 +13,15 @@ import (
 )
 
 // ApplyModule records a delivered module at a newer generation and holds a
-// module installation at every organization (a solution is installed
+// module installation at every organization, unless the host installs
+// modules itself (Config.HostInstallsModules; a solution is installed
 // explicitly). A narrowing invalidates the capabilities issued before it; a
 // withdrawn owner-aware declaration refuses its owner-selected ones for good.
 func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, error) {
 	if err := decide.ValidateModule(m); err != nil {
 		return nil, err
 	}
+	m.ResourceKinds = decide.Served(m)
 	var ids []string
 	err := s.store.Write(ctx, func(tx Tx) error {
 		ids = nil // a retried transaction starts over
@@ -95,7 +98,10 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e
 		if err := tx.PutModule(m); err != nil {
 			return err
 		}
-		if m.Kind == domain.KindSolution {
+		if err := s.journal(ctx, tx, domain.Event{Kind: domain.ModuleApplied, Subject: m.Name, Detail: map[string]string{"principal": m.Principal, "kind": m.Kind, "generation": fmt.Sprint(m.Generation)}}); err != nil {
+			return err
+		}
+		if m.Kind == domain.KindSolution || s.cfg.HostInstallsModules {
 			return nil
 		}
 		orgs, err := tx.Organizations()
@@ -131,6 +137,95 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e
 	return ids, err
 }
 
+// OrganizationAdded holds every composed module installed at an organization
+// the host created after those modules were delivered, as ApplyModule holds
+// them at every organization that existed then: the order of delivery and
+// sign-up never decides whether an organization may use a module. It is
+// idempotent, and a module installation an administrator or a withdrawal
+// retired stays retired. It answers the organization's module installations.
+func (s *Service) OrganizationAdded(ctx context.Context, org string) ([]string, error) {
+	var ids []string
+	err := s.store.Write(ctx, func(tx Tx) error {
+		ids = nil
+		if _, err := tx.Organization(org); err != nil {
+			return notFound(err)
+		}
+		if s.cfg.HostInstallsModules {
+			return nil // the host installs a module where its administrators consent
+		}
+		modules, err := tx.Modules()
+		if err != nil {
+			return err
+		}
+		for _, m := range modules {
+			if m.Kind == domain.KindSolution {
+				continue
+			}
+			id := s.cfg.InstallationID(org, m.Name)
+			if _, err := tx.Installation(id); errors.Is(err, domain.ErrNotFound) {
+				if err := tx.PutInstallation(domain.Installation{ID: id, Organization: org, Target: m.Name, Status: domain.Active, Revision: 1}); err != nil {
+					return err
+				}
+			} else if err != nil {
+				return err
+			}
+			ids = append(ids, id)
+		}
+		slices.Sort(ids)
+		return nil
+	})
+	return ids, err
+}
+
+// ReconcileOrganizations holds every composed module at every organization
+// (OrganizationAdded at each), and does nothing when the host installs modules: what a host runs when it starts, so an
+// organization created while the authority could not record it still holds
+// the modules it may use.
+func (s *Service) ReconcileOrganizations(ctx context.Context) error {
+	if s.cfg.HostInstallsModules {
+		return nil // nothing is installed by the core to reconcile
+	}
+	// One read finds the organizations missing a module installation, so a
+	// host with many organizations writes only where something is missing.
+	var missing []string
+	if err := s.store.Read(ctx, func(tx Tx) error {
+		missing = nil
+		orgs, err := tx.Organizations()
+		if err != nil {
+			return err
+		}
+		modules, err := tx.Modules()
+		if err != nil {
+			return err
+		}
+		all, err := tx.Installations("")
+		if err != nil {
+			return err
+		}
+		held := map[string]bool{}
+		for _, inst := range all {
+			held[inst.ID] = true
+		}
+		for _, org := range orgs {
+			for _, m := range modules {
+				if m.Kind != domain.KindSolution && !held[s.cfg.InstallationID(org.ID, m.Name)] {
+					missing = append(missing, org.ID)
+					break
+				}
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	for _, org := range missing {
+		if _, err := s.OrganizationAdded(ctx, org); err != nil {
+			return fmt.Errorf("organization %s: %w", org, err)
+		}
+	}
+	return nil
+}
+
 // WithdrawModule removes a module: its installations are revoked and the
 // delegations granted to it end.
 func (s *Service) WithdrawModule(ctx context.Context, name string) error {
@@ -139,8 +234,13 @@ func (s *Service) WithdrawModule(ctx context.Context, name string) error {
 		if err != nil {
 			return err
 		}
+		withdrawn, err := tx.ModuleNamed(name)
+		if err != nil {
+			return notFound(err)
+		}
+		hostOwned := s.cfg.HostInstallsModules && withdrawn.Kind != domain.KindSolution
 		for _, inst := range all {
-			if inst.Target == name && inst.Status != domain.Revoked {
+			if inst.Target == name && inst.Status != domain.Revoked && !hostOwned {
 				if err := s.revoke(tx, inst); err != nil {
 					return err
 				}
@@ -161,13 +261,13 @@ func (s *Service) WithdrawModule(ctx context.Context, name string) error {
 				}
 			}
 		}
-		m, err := tx.ModuleNamed(name)
-		if err != nil {
-			return notFound(err)
-		}
+		m := withdrawn
 		if err := tx.PutTombstone(domain.Tombstone{Name: m.Name, Principal: m.Principal, Generation: m.Generation}); err != nil {
 			return err
 		}
+		if err := s.journal(ctx, tx, domain.Event{Kind: domain.ModuleWithdrawn, Subject: m.Name, Detail: map[string]string{"principal": m.Principal, "generation": fmt.Sprint(m.Generation)}}); err != nil {
+			return err
+		}
 		return tx.DeleteModule(name)
 	})
 }
@@ -229,7 +329,7 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 		if _, ok := m.Roles[agentRole]; !ok {
 			return domain.Missing("role %q is not one %s declares", agentRole, target)
 		}
-		p, err := tx.Person(installedBy)
+		p, err := tx.Member(org, installedBy)
 		if err != nil && !errors.Is(err, domain.ErrNotFound) {
 			return err
 		}
@@ -269,13 +369,16 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 					return err
 				}
 				inst = existing
-				return tx.PutInstallation(existing)
+				if err := tx.PutInstallation(existing); err != nil {
+					return err
+				}
+				return s.journal(ctx, tx, requested(caller, existing))
 			}
 			inst = existing
 			return nil
 		}
 		if err == nil && existing.Status != domain.Revoked {
-			return domain.Refuse("%s is already installed at %s", target, org)
+			return &domain.Refusal{Code: domain.Denied, Cause: domain.ErrAlreadyInstalled, Reason: fmt.Sprintf("%s is already installed at %s", target, org)}
 		}
 		principal := s.cfg.PrincipalID(org, target)
 		if _, err := tx.Module(principal); err == nil {
@@ -306,7 +409,10 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 		if err := tx.DeleteRoleGrants(id); err != nil {
 			return err
 		}
-		return tx.PutInstallation(inst)
+		if err := tx.PutInstallation(inst); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, requested(caller, inst))
 	})
 	if err != nil {
 		return inst, err
@@ -349,24 +455,35 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 		}
 		current.Status = domain.Active
 		inst = current
-		return tx.PutInstallation(current)
+		if err := tx.PutInstallation(current); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, domain.Event{Kind: domain.InstallationActivated, Organization: current.Organization, Actor: caller.ID, Subject: current.ID,
+			Detail: map[string]string{"target": current.Target, "revision": fmt.Sprint(current.Revision)}})
 	})
 	return inst, err
 }
 
+// requested is the journal entry of an installation attempt recorded pending.
+func requested(caller Person, inst domain.Installation) domain.Event {
+	return domain.Event{Kind: domain.InstallationRequested, Organization: inst.Organization, Actor: caller.ID, Subject: inst.ID,
+		Detail: map[string]string{"target": inst.Target, "role": inst.AgentRole, "principal": inst.PrincipalID, "installed_by": inst.InstalledBy,
+			"revision": fmt.Sprint(inst.Revision), "operation": inst.Consent.OperationID}}
+}
+
 // Uninstall disables a solution installation and its principal at once, clears
 // its grants and revokes capabilities sealed to it or its organization. The
 // caller must currently administer the organization. Module installations
 // belong to host composition and cannot be uninstalled by a person.
 func (s *Service) Uninstall(ctx context.Context, caller Person, organization, installationID string) error {
 	return s.store.Write(ctx, func(tx Tx) error {
-		p, err := tx.Person(caller.ID)
+		p, err := memberAs(tx, caller, organization)
 		if err != nil && !errors.Is(err, domain.ErrNotFound) {
 			return err
 		}
 		// Authorize before reading the installation: unauthorized callers
 		// cannot tell a present installation from an absent one.
-		if caller.ID == "" || err != nil || p.Organization != organization || !decide.IsAdministrator(p) {
+		if err != nil || !decide.IsAdministrator(p) {
 			return decide.ForeignInstallation(installationID, organization)
 		}
 		inst, err := installationIn(tx, organization, installationID)
@@ -378,7 +495,10 @@ func (s *Service) Uninstall(ctx context.Context, caller Person, organization, in
 		if inst.PrincipalID == "" || inst.InstalledBy == "" {
 			return domain.Refuse("%s is a module, installed by composition: it is withdrawn, never uninstalled", inst.Target)
 		}
-		return s.revoke(tx, inst)
+		if err := s.revoke(tx, inst); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, uninstalled(caller.ID, inst))
 	})
 }
 
@@ -391,10 +511,23 @@ func (s *Service) UninstallAsHost(ctx context.Context, organization, installatio
 		if err != nil {
 			return err
 		}
-		return s.revoke(tx, inst)
+		if s.cfg.HostInstallsModules && inst.PrincipalID == "" {
+			if m, err := tx.ModuleNamed(inst.Target); err == nil && m.Kind != domain.KindSolution {
+				return domain.Refuse("%s is a module installed by its host's consent; the host uninstalls it", inst.Target)
+			}
+		}
+		if err := s.revoke(tx, inst); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, uninstalled("", inst))
 	})
 }
 
+func uninstalled(actor string, inst domain.Installation) domain.Event {
+	return domain.Event{Kind: domain.InstallationUninstalled, Organization: inst.Organization, Actor: actor, Subject: inst.ID,
+		Detail: map[string]string{"target": inst.Target, "revision": fmt.Sprint(inst.Revision + 1)}}
+}
+
 func installationIn(tx Tx, organization, installationID string) (domain.Installation, error) {
 	inst, err := tx.Installation(installationID)
 	if errors.Is(err, domain.ErrNotFound) || (err == nil && inst.Organization != organization) {
@@ -422,8 +555,8 @@ func (s *Service) revoke(tx Tx, inst domain.Installation) error {
 func (s *Service) Installations(ctx context.Context, caller Person, org string) ([]domain.Installation, error) {
 	var out []domain.Installation
 	err := s.store.Read(ctx, func(tx Tx) error {
-		p, err := tx.Person(caller.ID)
-		if err != nil || p.Organization != org || !decide.IsAdministrator(p) {
+		p, err := memberAs(tx, caller, org)
+		if err != nil || !decide.IsAdministrator(p) {
 			return domain.Refuse("installation administration requires an administrator or owner of organization %q", org)
 		}
 		out, err = tx.Installations(org)
@@ -431,3 +564,13 @@ func (s *Service) Installations(ctx context.Context, caller Person, org string)
 	})
 	return out, err
 }
+
+// Composed answers a composed module by name, as its delivery declared it.
+func (s *Service) Composed(ctx context.Context, name string) (domain.Module, error) {
+	var m domain.Module
+	err := s.store.Read(ctx, func(tx Tx) (err error) {
+		m, err = tx.ModuleNamed(name)
+		return notFound(err)
+	})
+	return m, err
+}
diff --git a/libraries/authority-core/go/authority/membership_test.go b/libraries/authority-core/go/authority/membership_test.go
new file mode 100644
index 00000000..3bd663c3
--- /dev/null
+++ b/libraries/authority-core/go/authority/membership_test.go
@@ -0,0 +1,87 @@
+package authority_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// A person may belong to several organizations. What they hold, administer
+// and may be granted is read from their membership of the organization the
+// session was opened at, never from another one.
+func TestAPersonOfTwoOrganizationsActsOnlyAsTheMemberOfTheSessions(t *testing.T) {
+	h := newHarness(t)
+	h.store.PutOrgRole(domain.OrgRole{Organization: globex, Name: "store-writer", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"write"}}}})
+	h.store.PutOrgRole(domain.OrgRole{Organization: acme, Name: "store-plain-reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}}}})
+	h.store.PutPerson(domain.Person{ID: "pat", Organization: acme, Roles: []string{"store-plain-reader"}})
+	h.store.PutPerson(domain.Person{ID: "pat", Organization: globex, Roles: []string{"admin", "store-writer"}})
+	atAcme := authority.Person{ID: "pat", Organization: acme, SessionID: "s-acme"}
+	atGlobex := authority.Person{ID: "pat", Organization: globex, SessionID: "s-globex"}
+	read, write := []*basev0.WorkScopeV1{sc(kind, "read")}, []*basev0.WorkScopeV1{sc(kind, "write")}
+
+	for _, tc := range []struct {
+		name    string
+		who     authority.Person
+		scopes  []*basev0.WorkScopeV1
+		allowed bool
+	}{
+		{"acme's role at acme", atAcme, read, true},
+		{"globex's role does not reach acme", atAcme, write, false},
+		{"globex's role at globex", atGlobex, write, true},
+		{"acme's role does not reach globex", atGlobex, read, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := h.svc.IssueForPerson(h.ctx, tc.who, authority.IssueRequest{Audience: "store", Scopes: tc.scopes})
+			if tc.allowed && err != nil {
+				t.Fatal(err)
+			}
+			if !tc.allowed {
+				code(t, err, domain.Denied)
+			}
+		})
+	}
+
+	t.Run("administration is the session organization's", func(t *testing.T) {
+		if _, err := h.svc.Installations(h.ctx, atGlobex, globex); err != nil {
+			t.Fatal(err)
+		}
+		_, err := h.svc.Installations(h.ctx, atAcme, globex)
+		refused(t, err, "requires an administrator")
+		_, err = h.svc.Installations(h.ctx, atAcme, acme)
+		refused(t, err, "requires an administrator")
+		_, err = h.svc.Review(h.ctx, atAcme, globex, "b")
+		refused(t, err, "requires an administrator")
+		_, err = h.svc.GrantRole(h.ctx, atAcme, authority.RoleRequest{Organization: globex, InstallationID: h.inst(globex, "a").ID, Role: "viewer", PersonID: "pat"})
+		refused(t, err, "another organization")
+	})
+
+	t.Run("a role granted at one organization's installation counts there alone", func(t *testing.T) {
+		h.grant("a", "viewer", "pat")
+		if _, err := h.svc.IssueForPerson(h.ctx, atAcme, authority.IssueRequest{Audience: "a"}); err != nil {
+			t.Fatal(err)
+		}
+		_, err := h.svc.IssueForPerson(h.ctx, atGlobex, authority.IssueRequest{Audience: "a"})
+		refused(t, err, "holds no role")
+	})
+
+	t.Run("a person is granted a role only as a member of the installation's organization", func(t *testing.T) {
+		_, err := h.svc.GrantRole(h.ctx, h.person("alex"), authority.RoleRequest{Organization: acme, InstallationID: h.inst(acme, "a").ID, Role: "viewer", PersonID: "omar"})
+		refused(t, err, "is not a member of")
+	})
+
+	t.Run("leaving one organization leaves the other membership standing", func(t *testing.T) {
+		h.store.DeleteMember(acme, "pat")
+		_, err := h.svc.IssueForPerson(h.ctx, atAcme, authority.IssueRequest{Audience: "store", Scopes: read})
+		refused(t, err, "no longer a member")
+		if _, err := h.svc.IssueForPerson(h.ctx, atGlobex, authority.IssueRequest{Audience: "store", Scopes: write}); err != nil {
+			t.Fatal(err)
+		}
+	})
+
+	t.Run("a session with no organization acts nowhere", func(t *testing.T) {
+		_, err := h.svc.Installations(h.ctx, authority.Person{ID: "pat"}, globex)
+		refused(t, err, "requires an administrator")
+	})
+}
diff --git a/libraries/authority-core/go/authority/organization_added_test.go b/libraries/authority-core/go/authority/organization_added_test.go
new file mode 100644
index 00000000..c1f06bfd
--- /dev/null
+++ b/libraries/authority-core/go/authority/organization_added_test.go
@@ -0,0 +1,114 @@
+package authority_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// An organization created after the modules were delivered holds each of
+// them as an organization that existed then does; a retired installation
+// stays retired, and asking twice changes nothing.
+func TestAnOrganizationAddedLaterHoldsEveryComposedModule(t *testing.T) {
+	h := newHarness(t)
+	const initech = "initech"
+	h.store.PutOrganization(domain.Organization{ID: initech, Name: initech})
+	h.store.PutPerson(domain.Person{ID: "ivy", Organization: initech})
+	h.store.PutOrgRole(domain.OrgRole{Organization: initech, Name: "reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}}}})
+	h.store.PutPerson(domain.Person{ID: "ivy", Organization: initech, Roles: []string{"reader"}})
+	ivy := authority.Person{ID: "ivy", Organization: initech, SessionID: "s-ivy"}
+	_, err := h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}})
+	code(t, err, domain.Precondition)
+
+	ids, err := h.svc.OrganizationAdded(h.ctx, initech)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 2 { // store and legacy-store; solutions are installed explicitly
+		t.Fatalf("module installations %v", ids)
+	}
+	if _, err := h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.svc.UninstallAsHost(h.ctx, initech, authority.StableInstallationID(initech, "store")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.svc.OrganizationAdded(h.ctx, initech); err != nil {
+		t.Fatal(err)
+	}
+	_, err = h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}})
+	code(t, err, domain.Precondition)
+	_, err = h.svc.OrganizationAdded(h.ctx, "nobody")
+	code(t, err, domain.NotFound)
+
+	// Reconciling every organization holds what is missing and nothing more.
+	const hooli = "hooli"
+	h.store.PutOrganization(domain.Organization{ID: hooli, Name: hooli})
+	if err := h.svc.ReconcileOrganizations(h.ctx); err != nil {
+		t.Fatal(err)
+	}
+	ids, err = h.svc.OrganizationAdded(h.ctx, hooli)
+	if err != nil || len(ids) != 2 {
+		t.Fatalf("reconciled module installations %v %v", ids, err)
+	}
+	_, err = h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}})
+	code(t, err, domain.Precondition)
+}
+
+// The host's own setup grants a role as the organization's administrator
+// would: on an active installation of that organization, a declared role, to
+// a member or a team of it.
+func TestTheHostGrantsARoleAsTheAdministratorWould(t *testing.T) {
+	h := newHarness(t)
+	inst := h.inst(acme, "a").ID
+	for _, tc := range []struct {
+		name string
+		r    authority.RoleRequest
+		code domain.Code
+	}{
+		{"another organization's installation", authority.RoleRequest{Organization: globex, InstallationID: inst, Role: "viewer", PersonID: "omar"}, domain.Denied},
+		{"an undeclared role", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "owner", PersonID: "maya"}, domain.NotFound},
+		{"no subject", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer"}, domain.Invalid},
+		{"a person of another organization", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "omar"}, domain.Denied},
+		{"a team of another organization", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", TeamID: "ops"}, domain.Denied},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := h.svc.GrantRoleAsHost(h.ctx, tc.r)
+			code(t, err, tc.code)
+		})
+	}
+	if _, err := h.svc.GrantRoleAsHost(h.ctx, authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "maya"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.root("maya", "a"); err != nil {
+		t.Fatalf("the granted role is held: %v", err)
+	}
+	if _, err := h.svc.GrantRoleAsHost(h.ctx, authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", TeamID: "team"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.root("tam", "a"); err != nil {
+		t.Fatalf("the team's role is held: %v", err)
+	}
+}
+
+func TestAComposedModuleReadsAsDelivered(t *testing.T) {
+	h := newHarness(t)
+	m, err := h.svc.Composed(h.ctx, "a")
+	if err != nil || m.Principal != "a" || m.Kind != domain.KindSolution || len(m.Roles) != 4 {
+		t.Fatalf("composed %+v %v", m, err)
+	}
+	_, err = h.svc.Composed(h.ctx, "absent")
+	code(t, err, domain.NotFound)
+}
+
+func TestInstallingAnInstalledTargetNamesIt(t *testing.T) {
+	h := newHarness(t)
+	_, err := h.svc.InstallAsHost(h.ctx, acme, "a", "author", "alex", nil)
+	code(t, err, domain.Denied)
+	if !errors.Is(err, domain.ErrAlreadyInstalled) {
+		t.Fatalf("an installed target's refusal names it: %v", err)
+	}
+}
diff --git a/libraries/authority-core/go/authority/r152_test.go b/libraries/authority-core/go/authority/r152_test.go
index d4218da4..346ae3cf 100644
--- a/libraries/authority-core/go/authority/r152_test.go
+++ b/libraries/authority-core/go/authority/r152_test.go
@@ -86,6 +86,12 @@ func (t lifecycleOutageTx) Person(id string) (domain.Person, error) {
 	}
 	return t.Tx.Person(id)
 }
+func (t lifecycleOutageTx) Member(org, id string) (domain.Person, error) {
+	if t.fail == "person" {
+		return domain.Person{}, t.err
+	}
+	return t.Tx.Member(org, id)
+}
 func (t lifecycleOutageTx) Installation(id string) (domain.Installation, error) {
 	if t.fail == "installation" {
 		return domain.Installation{}, t.err
diff --git a/libraries/authority-core/go/authority/resource_scoped_role_test.go b/libraries/authority-core/go/authority/resource_scoped_role_test.go
new file mode 100644
index 00000000..3404dafa
--- /dev/null
+++ b/libraries/authority-core/go/authority/resource_scoped_role_test.go
@@ -0,0 +1,43 @@
+package authority_test
+
+import (
+	"testing"
+
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// Rob reads store-x alone through his organization role. What he is issued,
+// and every hop below it, names store-x and nothing else of the kind: a
+// module deciding from the token's claims never sees the whole kind.
+func TestAResourceScopedOrganizationRoleIssuesItsIDsAlone(t *testing.T) {
+	h := newHarness(t)
+	read := []string{"read"}
+	ids := func(of ...string) *basev0.WorkScopeV1 { return owned(kind, "", read, of...) }
+
+	root := h.must(h.root("rob", "store"))
+	exactly(t, root, kind, "", read, "store-x")
+	if err := h.check(root); err != nil {
+		t.Fatal(err)
+	}
+	grants, err := h.svc.ListResources(h.ctx, root.Token, "store", kind, "read")
+	if err != nil || len(grants) != 1 || grants[0].ID != "store-x" {
+		t.Fatalf("listed %v %v", grants, err)
+	}
+
+	for name, ask := range map[string]*basev0.WorkScopeV1{
+		"another id":         ids("store-y"),
+		"a held and another": ids("store-x", "store-y"),
+		"the whole kind":     sc(kind, "read"),
+	} {
+		t.Run("an ask naming "+name+" is refused", func(t *testing.T) {
+			_, err := h.root("rob", "store", ask)
+			refused(t, err, "widens")
+		})
+		t.Run("a child naming "+name+" is refused", func(t *testing.T) {
+			_, err := h.hop(root, "self", ask)
+			refused(t, err, "widens")
+		})
+	}
+	exactly(t, h.must(h.hop(root, "self")), kind, "", read, "store-x")
+	exactly(t, h.must(h.root("rob", "store", ids("store-x"))), kind, "", read, "store-x")
+}
diff --git a/libraries/authority-core/go/authority/roles.go b/libraries/authority-core/go/authority/roles.go
index 9c59d4f9..767e3a4a 100644
--- a/libraries/authority-core/go/authority/roles.go
+++ b/libraries/authority-core/go/authority/roles.go
@@ -19,18 +19,23 @@ func (r RoleRequest) grant() domain.RoleGrant {
 	return domain.RoleGrant{InstallationID: r.InstallationID, Role: r.Role, PersonID: r.PersonID, TeamID: r.TeamID}
 }
 
-// decideRoleChange reads what decide.ChangeRole needs.
-func decideRoleChange(tx Tx, caller Person, r RoleRequest, list, revoke bool) (domain.Installation, error) {
+// decideRoleChange reads what decide.ChangeRole needs. A nil caller is the
+// host's own setup, deciding as the organization's administrator would.
+func decideRoleChange(tx Tx, caller *Person, r RoleRequest, list, revoke bool) (domain.Installation, error) {
 	// A caller of another organization than the one named learns nothing of
 	// it: the foreign answer comes before any installation is read. Then the
 	// installation is resolved by (organization, id): another organization's
 	// and an absent one answer alike, having done the same work.
-	c, err := tx.Person(caller.ID)
-	if err != nil && !errors.Is(err, domain.ErrNotFound) {
-		return domain.Installation{}, err
-	}
-	if caller.ID == "" || err != nil || c.Organization != r.Organization {
-		return domain.Installation{}, decide.ForeignInstallation(r.InstallationID, r.Organization)
+	c := domain.Person{Organization: r.Organization, Roles: []string{"admin"}}
+	if caller != nil {
+		var err error
+		c, err = memberAs(tx, *caller, r.Organization)
+		if err != nil && !errors.Is(err, domain.ErrNotFound) {
+			return domain.Installation{}, err
+		}
+		if err != nil {
+			return domain.Installation{}, decide.ForeignInstallation(r.InstallationID, r.Organization)
+		}
 	}
 	inst, err := tx.Installation(r.InstallationID)
 	if errors.Is(err, domain.ErrNotFound) || (err == nil && inst.Organization != r.Organization) {
@@ -50,7 +55,7 @@ func decideRoleChange(tx Tx, caller Person, r RoleRequest, list, revoke bool) (d
 	change := decide.RoleChange{RequestOrganization: r.Organization, RequestedID: r.InstallationID, Installation: inst, Solution: solution,
 		Caller: c, CallerRoles: decide.HeldRoles(c, inst, grants), List: list, Revoke: revoke, Role: r.Role, PersonID: r.PersonID, TeamID: r.TeamID}
 	if r.PersonID != "" {
-		if p, err := tx.Person(r.PersonID); err == nil {
+		if p, err := tx.Member(inst.Organization, r.PersonID); err == nil {
 			change.Subject = &p
 		}
 	}
@@ -70,10 +75,36 @@ func (s *Service) GrantRole(ctx context.Context, caller Person, r RoleRequest) (
 	var inst domain.Installation
 	err := s.store.Write(ctx, func(tx Tx) error {
 		var err error
-		if inst, err = decideRoleChange(tx, caller, r, false, false); err != nil {
+		if inst, err = decideRoleChange(tx, &caller, r, false, false); err != nil {
+			return err
+		}
+		if err := tx.PutRoleGrant(r.grant()); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, r.event(domain.RoleGranted, caller.ID))
+	})
+	return inst, err
+}
+
+func (r RoleRequest) event(kind domain.EventKind, actor string) domain.Event {
+	return domain.Event{Kind: kind, Organization: r.Organization, Actor: actor, Subject: r.InstallationID,
+		Detail: map[string]string{"role": r.Role, "person": r.PersonID, "team": r.TeamID}}
+}
+
+// GrantRoleAsHost is for trusted host setup (a fixture's installations),
+// never a request handler: it grants a role with no caller, decided as
+// GrantRole decides it for the organization's administrator.
+func (s *Service) GrantRoleAsHost(ctx context.Context, r RoleRequest) (domain.Installation, error) {
+	var inst domain.Installation
+	err := s.store.Write(ctx, func(tx Tx) error {
+		var err error
+		if inst, err = decideRoleChange(tx, nil, r, false, false); err != nil {
+			return err
+		}
+		if err := tx.PutRoleGrant(r.grant()); err != nil {
 			return err
 		}
-		return tx.PutRoleGrant(r.grant())
+		return s.journal(ctx, tx, r.event(domain.RoleGranted, ""))
 	})
 	return inst, err
 }
@@ -85,7 +116,7 @@ func (s *Service) RevokeRole(ctx context.Context, caller Person, r RoleRequest)
 	var inst domain.Installation
 	err := s.store.Write(ctx, func(tx Tx) error {
 		var err error
-		if inst, err = decideRoleChange(tx, caller, r, false, true); err != nil {
+		if inst, err = decideRoleChange(tx, &caller, r, false, true); err != nil {
 			return err
 		}
 		if err := tx.DeleteRoleGrant(r.grant()); err != nil {
@@ -109,7 +140,7 @@ func (s *Service) RevokeRole(ctx context.Context, caller Person, r RoleRequest)
 				return err
 			}
 		}
-		return nil
+		return s.journal(ctx, tx, r.event(domain.RoleRevoked, caller.ID))
 	})
 	return inst, err
 }
@@ -118,7 +149,7 @@ func (s *Service) RevokeRole(ctx context.Context, caller Person, r RoleRequest)
 func (s *Service) ListRoleGrants(ctx context.Context, caller Person, organization, installationID string) ([]domain.RoleGrant, error) {
 	var out []domain.RoleGrant
 	err := s.store.Read(ctx, func(tx Tx) error {
-		if _, err := decideRoleChange(tx, caller, RoleRequest{Organization: organization, InstallationID: installationID}, true, false); err != nil {
+		if _, err := decideRoleChange(tx, &caller, RoleRequest{Organization: organization, InstallationID: installationID}, true, false); err != nil {
 			return err
 		}
 		var err error
@@ -134,14 +165,3 @@ func (s *Service) ListRoleGrants(ctx context.Context, caller Person, organizatio
 func (s *Service) PersonChanged(ctx context.Context, person string) error {
 	return s.store.Write(ctx, func(tx Tx) error { return tx.BumpPersonEpoch(person) })
 }
-
-// callerOrganization is the organization the caller belongs to now, read from
-// the store.
-func callerOrganization(tx Tx, caller Person) string {
-	if p, err := tx.Person(caller.ID); err == nil {
-		return p.Organization
-	}
-	// A caller the store no longer knows belongs to no organization: they get
-	// the foreign answer, whatever their session says.
-	return ""
-}
diff --git a/libraries/authority-core/go/authority/service.go b/libraries/authority-core/go/authority/service.go
index 5be0cdcd..61457442 100644
--- a/libraries/authority-core/go/authority/service.go
+++ b/libraries/authority-core/go/authority/service.go
@@ -48,6 +48,19 @@ type Config struct {
 	Replay workcontext.ReplayStore
 	// Grants answers approval grants; nil refuses every grant capability.
 	Grants workcontext.GrantSource
+	// Journal records each change of authority in the transaction that makes
+	// it; an error aborts the change. nil journals nothing.
+	Journal func(ctx context.Context, tx Tx, e domain.Event) error
+	// HostInstallsModules says the host decides which organizations hold each
+	// composed module, by its own administrators' consent, and its store
+	// answers those installations from the host's own records. The core then
+	// never installs, reactivates or revokes a module installation itself:
+	// delivery, a new organization and reconciliation install nothing,
+	// withdrawal leaves the host's records to the host, and UninstallAsHost
+	// refuses a module. It still raises a module installation's revision when
+	// a redelivery narrows the module, which the store applies to the host's
+	// record. false: every composed module is installed at every organization.
+	HostInstallsModules bool
 }
 
 var (
@@ -102,6 +115,14 @@ func New(store Store, cfg Config) (*Service, error) {
 	return s, nil
 }
 
+// journal records e in tx, when the host journals.
+func (s *Service) journal(ctx context.Context, tx Tx, e domain.Event) error {
+	if s.cfg.Journal == nil {
+		return nil
+	}
+	return s.cfg.Journal(ctx, tx, e)
+}
+
 // Seals and Revisions answer core's verifier and minter from the store.
 func (s *Service) Seals() workcontext.SealSource         { return s.src }
 func (s *Service) Revisions() workcontext.RevisionSource { return s.src }
@@ -117,6 +138,10 @@ type Person struct {
 // Workload is an attested module workload.
 type Workload struct {
 	Module string
+	// Organization is the organization the workload's credential is bound to,
+	// empty when it serves every organization that installed it. A workload
+	// bound to one is issued nothing at another.
+	Organization string
 }
 
 func (s *Service) verifier(ctx context.Context, audience string) (*workcontext.Verifier, error) {
@@ -224,8 +249,8 @@ func (src sources) holds(tx Tx, principal string, inst domain.Installation) (boo
 	} else if !errors.Is(err, domain.ErrNotFound) {
 		return false, err
 	}
-	if p, err := tx.Person(principal); err == nil {
-		return p.Organization == inst.Organization, nil
+	if _, err := tx.Member(inst.Organization, principal); err == nil {
+		return true, nil
 	} else if !errors.Is(err, domain.ErrNotFound) {
 		return false, err
 	}
@@ -332,16 +357,28 @@ func (src sources) OperationBinding(ctx context.Context, id string) (workcontext
 	return out, err
 }
 
-// installationOf is an organization's installation of target.
+// installationOf is an organization's installation of target: its active one
+// when it has one, since a host that installs modules keeps the records of the
+// installations it retired beside the one it made again.
 func installationOf(tx Tx, org, target string) (domain.Installation, error) {
 	all, err := tx.Installations(org)
 	if err != nil {
 		return domain.Installation{}, err
 	}
-	for _, inst := range all {
-		if inst.Target == target {
+	var found *domain.Installation
+	for i, inst := range all {
+		if inst.Target != target {
+			continue
+		}
+		if inst.Status == domain.Active {
 			return inst, nil
 		}
+		if found == nil {
+			found = &all[i]
+		}
+	}
+	if found != nil {
+		return *found, nil
 	}
 	return domain.Installation{}, fmt.Errorf("installation of %s at %s: %w", target, org, domain.ErrNotFound)
 }
diff --git a/libraries/authority-core/go/authority/store.go b/libraries/authority-core/go/authority/store.go
index ab370bca..82d5362b 100644
--- a/libraries/authority-core/go/authority/store.go
+++ b/libraries/authority-core/go/authority/store.go
@@ -27,7 +27,13 @@ var ErrConflict = errors.New("authority: the transaction conflicted with another
 type Tx interface {
 	Organizations() ([]domain.Organization, error)
 	Organization(id string) (domain.Organization, error)
+	// Person answers whether id names a person at all, in any organization.
+	// A person may belong to several organizations, so the authority reads
+	// nothing else from it: what a person holds is read through Member.
 	Person(id string) (domain.Person, error)
+	// Member is a person as a member of one organization: their roles and
+	// teams there. A person who is not a member of it is ErrNotFound.
+	Member(organization, id string) (domain.Person, error)
 	People(organization string) ([]domain.Person, error)
 	OrgRole(organization, name string) (domain.OrgRole, error)
 
diff --git a/libraries/authority-core/go/authority/transfer.go b/libraries/authority-core/go/authority/transfer.go
index 174c9e7f..59ed1364 100644
--- a/libraries/authority-core/go/authority/transfer.go
+++ b/libraries/authority-core/go/authority/transfer.go
@@ -72,7 +72,7 @@ func (s *Service) AuthorizeTransfer(ctx context.Context, r TransferRequest) (Tra
 		if t.OwnerKind != "human" {
 			return decide.AuthorizeTransfer(t)
 		}
-		p, err := tx.Person(wc.GetOwnerPrincipalId())
+		p, err := tx.Member(wc.GetTenantId(), wc.GetOwnerPrincipalId())
 		if err != nil {
 			return domain.Refuse("the owner %s is no longer a member", wc.GetOwnerPrincipalId())
 		}
@@ -92,7 +92,7 @@ func (s *Service) AuthorizeTransfer(ctx context.Context, r TransferRequest) (Tra
 		} else if !errors.Is(err, domain.ErrNotFound) {
 			return err
 		}
-		if fp, err := tx.Person(r.From); err == nil {
+		if fp, err := tx.Member(wc.GetTenantId(), r.From); err == nil {
 			t.FromPerson = &fp
 		}
 		roles, err := orgRoles(tx, p)
@@ -130,7 +130,8 @@ func (s *Service) AuthorizeTransfer(ctx context.Context, r TransferRequest) (Tra
 			return err
 		}
 		decision = TransferDecision{PrincipalID: r.To, AuthorizedBy: p.ID}
-		return nil
+		return s.journal(ctx, tx, domain.Event{Kind: domain.ResourceTransferred, Organization: target.Organization, Actor: p.ID, Subject: target.ID,
+			Detail: map[string]string{"kind": r.Kind, "resource": r.ResourceID, "from": r.From, "to": r.To, "store": r.Store.Module}})
 	})
 	return decision, err
 }
diff --git a/libraries/authority-core/go/decide/decide.go b/libraries/authority-core/go/decide/decide.go
index e30025c7..c137347d 100644
--- a/libraries/authority-core/go/decide/decide.go
+++ b/libraries/authority-core/go/decide/decide.go
@@ -23,23 +23,72 @@ func IsAdministrator(p domain.Person) bool {
 
 // OrgScopes is what a person's organization roles grant at audience: the
 // union of their scopes (AnyKind spanning every served kind) within what the
-// audience serves. Resource matchers are ListResources' (ResourceGrants).
-func OrgScopes(roles []domain.OrgRole, audience domain.Module) Scopes {
+// audience serves. A role scope naming no resource holds the whole kind; one
+// naming resources holds exactly the ids its matchers select (heldIDs), never
+// the whole kind, so Issue refuses an ask naming any other id and an empty
+// ask carries those ids. named is what the decision is about: the ask, and
+// the capability a hop or a delegation derives from.
+func OrgScopes(roles []domain.OrgRole, audience domain.Module, named Scopes) Scopes {
 	var held Scopes
 	for _, role := range roles {
 		for _, sc := range role.Scopes {
+			kinds := []string{sc.Kind}
 			if sc.Kind == scope.AnyKind {
+				kinds = kinds[:0]
 				for _, kind := range audience.ResourceKinds {
-					held = append(held, &basev0.WorkScopeV1{ResourceKind: kind.GetResourceKind(), Actions: slices.Clone(sc.Actions)})
+					kinds = append(kinds, kind.GetResourceKind())
 				}
-				continue
 			}
-			held = append(held, &basev0.WorkScopeV1{ResourceKind: sc.Kind, Actions: slices.Clone(sc.Actions)})
+			for _, kind := range kinds {
+				ids, all := heldIDs(sc.Resources, kind, named)
+				if !all && len(ids) == 0 {
+					// No row: a row naming no id is the whole kind.
+					continue
+				}
+				held = append(held, &basev0.WorkScopeV1{ResourceKind: kind, Actions: slices.Clone(sc.Actions), ResourceIds: ids})
+			}
 		}
 	}
 	return scope.Intersect(scope.Normalize(held), audience.ResourceKinds)
 }
 
+// heldIDs is what a role scope's matchers hold of kind: every resource when
+// they name none or All; otherwise each ID matcher's id, and of a prefix or a
+// pattern only the ids named on kind that it matches. A token cannot carry a
+// prefix or a pattern, and carrying it as the whole kind would hand a module
+// reading the token every resource of the kind, so an ask naming no id holds
+// none of it: the person names the ids they act on. Matchers that do not
+// compile hold nothing.
+func heldIDs(grants []resources.Grant, kind string, named Scopes) (ids []string, all bool) {
+	if len(grants) == 0 {
+		return nil, true
+	}
+	m, err := resources.Compile(grants)
+	if err != nil {
+		return nil, false
+	}
+	if m.All() {
+		return nil, true
+	}
+	for _, g := range grants {
+		if g.ID != "" {
+			ids = append(ids, g.ID)
+		}
+	}
+	for _, sc := range named {
+		if sc.GetResourceKind() != kind {
+			continue
+		}
+		for _, id := range sc.GetResourceIds() {
+			if m.Matches(id) {
+				ids = append(ids, id)
+			}
+		}
+	}
+	slices.Sort(ids)
+	return slices.Compact(ids), false
+}
+
 // ResourceGrants are the resource matchers of every organization-role scope
 // holding action on kind, or every resource for a scope that names none.
 func ResourceGrants(roles []domain.OrgRole, kind, action string) []resources.Grant {
diff --git a/libraries/authority-core/go/decide/decide_test.go b/libraries/authority-core/go/decide/decide_test.go
index 94fca055..8c4049e2 100644
--- a/libraries/authority-core/go/decide/decide_test.go
+++ b/libraries/authority-core/go/decide/decide_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
 	resources "github.com/codefly-dev/authority/libraries/resources/go"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 )
@@ -217,7 +218,8 @@ func TestATransferIsDecidedInOrder(t *testing.T) {
 func TestOrganizationGrantsAndModules(t *testing.T) {
 	audience := domain.Module{ResourceKinds: []*basev0.WorkScopeV1{sc("doc", "read", "admin")}}
 	roles := []domain.OrgRole{{Name: "r", Scopes: []domain.RoleScope{{Kind: "*", Actions: []string{"read"}}, {Kind: "doc", Actions: []string{"admin"}, Resources: []resources.Grant{{ID: "x"}}}}}}
-	if got := decide.OrgScopes(roles, audience); len(got) != 1 || len(got[0].GetActions()) != 2 {
+	// read holds the whole kind; admin holds x alone, never the kind.
+	if got := decide.OrgScopes(roles, audience, nil); !scope.Same(got, []*basev0.WorkScopeV1{sc("doc", "read"), owned("doc", "", []string{"admin"}, "x")}) {
 		t.Fatalf("org scopes %v", got)
 	}
 	if got := decide.ResourceGrants(roles, "doc", "admin"); len(got) != 1 || got[0].ID != "x" {
diff --git a/libraries/authority-core/go/decide/manifest.go b/libraries/authority-core/go/decide/manifest.go
index 9e9324cd..828c5e60 100644
--- a/libraries/authority-core/go/decide/manifest.go
+++ b/libraries/authority-core/go/decide/manifest.go
@@ -8,6 +8,7 @@ import (
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
 	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 )
 
 // ValidateModule holds a delivered module to its contract: a principal, a
@@ -15,6 +16,13 @@ import (
 // a module declares no roles; a solution declares installer, and every role
 // stays within what it serves or consumes through invoke/lookup bindings.
 func ValidateModule(m domain.Module) error {
+	if err := validateModule(m); err != nil {
+		return err
+	}
+	return noOwners(m)
+}
+
+func validateModule(m domain.Module) error {
 	if m.Name == "" || m.Principal == "" || m.Generation == 0 {
 		return domain.Refuse("a manifest names its module, its principal and a generation")
 	}
@@ -119,3 +127,58 @@ func Narrowed(previous, next domain.Module) bool {
 	}
 	return false
 }
+
+// noOwners refuses a delivery naming a resource owner where none belongs: in
+// what a module serves, in a binding's scopes, in a role or in a method's
+// requirement. An owner is the authority's to select per installation; read
+// owner-blind, it would widen to the whole kind, so it is refused by name.
+func noOwners(m domain.Module) error {
+	check := func(where string, scopes Scopes) error {
+		for _, sc := range scopes {
+			if sc.GetResourceOwnerId() != "" {
+				return domain.Refuse("%s: %s names resource owner %q; a delivery never selects an owner", where, sc.GetResourceKind(), sc.GetResourceOwnerId())
+			}
+		}
+		return nil
+	}
+	if err := check(m.Name+" serves", m.ResourceKinds); err != nil {
+		return err
+	}
+	for _, id := range slices.Sorted(maps.Keys(m.Bindings)) {
+		b := m.Bindings[id]
+		for _, scopes := range []Scopes{b.InvokeScopes, b.HeadlessScopes, b.LookupScopes} {
+			if err := check(m.Name+" binding "+id, scopes); err != nil {
+				return err
+			}
+		}
+	}
+	for _, name := range slices.Sorted(maps.Keys(m.Roles)) {
+		if err := check(m.Name+" role "+name, m.Roles[name]); err != nil {
+			return err
+		}
+	}
+	for _, name := range slices.Sorted(maps.Keys(m.OwnedRoles)) {
+		if err := check(m.Name+" installation-owned role "+name, m.OwnedRoles[name]); err != nil {
+			return err
+		}
+	}
+	for _, method := range slices.Sorted(maps.Keys(m.Methods)) {
+		if err := check(m.Name+" method "+method, m.Methods[method].Requires); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Served is what a module serves: the kinds it declares, joined to every
+// (kind, action) its methods require of a call, read from its own method
+// declarations.
+func Served(m domain.Module) Scopes {
+	served := slices.Clone(m.ResourceKinds)
+	for _, method := range slices.Sorted(maps.Keys(m.Methods)) {
+		for _, required := range m.Methods[method].Requires {
+			served = append(served, &basev0.WorkScopeV1{ResourceKind: required.GetResourceKind(), Actions: slices.Clone(required.GetActions())})
+		}
+	}
+	return scope.Normalize(served)
+}
diff --git a/libraries/authority-core/go/decide/method.go b/libraries/authority-core/go/decide/method.go
new file mode 100644
index 00000000..6803c332
--- /dev/null
+++ b/libraries/authority-core/go/decide/method.go
@@ -0,0 +1,104 @@
+package decide
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	"github.com/codefly-dev/authority/libraries/hop/go/routing"
+)
+
+// AdmitMethod applies what the module m (the audience a call is checked for)
+// declares for method to the scopes the checked call holds. A method that m
+// does not declare is NotFound; a module that declares no method policy, a
+// method declaring nothing, or one declaring both that it requires scopes and
+// that it requires none, is refused: an absent or ambiguous declaration is
+// never read as permission. Method admission checks kinds and actions only:
+// the module still checks each resource, and its owner, against the
+// unchanged scopes.
+//
+// method is a full protobuf procedure, or an HTTP request "<VERB> <path>"
+// admitted under the one route template "<VERB> <template>" its path is an
+// instance of; two matching templates are refused rather than guessed between.
+func AdmitMethod(m domain.Module, method string, held Scopes) error {
+	audience := m.Principal
+	if m.Methods == nil {
+		return domain.Refuse("%s's delivery declares no method policy, so %s is refused", audience, method)
+	}
+	p, ok := m.Methods[method]
+	if !ok {
+		var err error
+		if p, ok, err = routeOf(m.Methods, method); err != nil {
+			return domain.Refuse("%s: %v", audience, err)
+		}
+	}
+	switch {
+	case !ok:
+		return domain.Missing("%s serves no method %s", audience, method)
+	case p.AnyCheckedCaller && len(p.Requires) > 0:
+		return domain.Refuse("%s declares for %s both that it requires scopes and that it requires none", audience, method)
+	case p.AnyCheckedCaller:
+		return nil
+	case len(p.Requires) == 0:
+		return domain.Refuse("%s declares no policy for %s", audience, method)
+	}
+	var missing []string
+	for _, r := range p.Requires {
+		for _, action := range r.GetActions() {
+			if !scope.HoldsAction(held, r.GetResourceKind(), action) {
+				missing = append(missing, r.GetResourceKind()+":"+action)
+			}
+		}
+	}
+	if len(missing) > 0 {
+		return domain.Refuse("%s requires %s for %s, which the call does not hold (it holds %s)",
+			audience, strings.Join(missing, ", "), method, describe(held))
+	}
+	return nil
+}
+
+// routeOf is the route a module declares that an HTTP request "<VERB> <path>"
+// is for.
+func routeOf(methods map[string]domain.MethodPolicy, request string) (domain.MethodPolicy, bool, error) {
+	verb, path, ok := strings.Cut(request, " ")
+	if !ok || !strings.HasPrefix(path, "/") {
+		return domain.MethodPolicy{}, false, nil
+	}
+	var found []string
+	for declared := range methods {
+		if v, template, ok := strings.Cut(declared, " "); ok && v == verb && routing.RouteMatches(template, path) {
+			found = append(found, declared)
+		}
+	}
+	switch len(found) {
+	case 0:
+		return domain.MethodPolicy{}, false, nil
+	case 1:
+		return methods[found[0]], true, nil
+	}
+	slices.Sort(found)
+	return domain.MethodPolicy{}, false, fmt.Errorf("%s matches more than one declared route (%s)", request, strings.Join(found, ", "))
+}
+
+// describe names what a call holds, for a refusal.
+func describe(held Scopes) string {
+	var out []string
+	for _, h := range held {
+		for _, a := range h.GetActions() {
+			permission := h.GetResourceKind() + ":" + a
+			switch {
+			case h.GetResourceOwnerId() != "":
+				permission += " (owner-selected)"
+			case len(h.GetResourceIds()) > 0:
+				permission += " (resource-limited)"
+			}
+			out = append(out, permission)
+		}
+	}
+	if len(out) == 0 {
+		return "nothing"
+	}
+	return strings.Join(out, ", ")
+}
diff --git a/libraries/authority-core/go/decide/method_test.go b/libraries/authority-core/go/decide/method_test.go
new file mode 100644
index 00000000..0b3c9030
--- /dev/null
+++ b/libraries/authority-core/go/decide/method_test.go
@@ -0,0 +1,145 @@
+package decide_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+func ws(kind string, ids []string, actions ...string) *basev0.WorkScopeV1 {
+	return &basev0.WorkScopeV1{ResourceKind: kind, Actions: actions, ResourceIds: ids}
+}
+
+func reads(kind string) domain.MethodPolicy {
+	return domain.MethodPolicy{Requires: []*basev0.WorkScopeV1{ws(kind, nil, "read")}}
+}
+
+// Every rule of method admission, allowed and refused, with the refusal's
+// code: a method not declared is NotFound, every other refusal Denied.
+func TestMethodAdmission(t *testing.T) {
+	gauge := domain.Module{Name: "gauge", Principal: "gauge", Methods: map[string]domain.MethodPolicy{
+		"/gauge.Service/List":                      reads("gauge.items"),
+		"/gauge.Service/Edit":                      {Requires: []*basev0.WorkScopeV1{ws("gauge.items", nil, "read", "write")}},
+		"/gauge.Service/Ping":                      {AnyCheckedCaller: true},
+		"/gauge.Service/Both":                      {AnyCheckedCaller: true, Requires: []*basev0.WorkScopeV1{ws("gauge.items", nil, "read")}},
+		"/gauge.Service/Empty":                     {},
+		"GET /v1/gauge/profiles":                   reads("gauge.profiles"),
+		"GET /v1/gauge/profiles/{ref}":             reads("gauge.profiles"),
+		"POST /v1/gauge/matches/{match_id}:settle": {Requires: []*basev0.WorkScopeV1{ws("gauge.profiles", nil, "write")}},
+		"GET /v1/gauge/{a}/x":                      {AnyCheckedCaller: true},
+		"GET /v1/gauge/{b}/x":                      {AnyCheckedCaller: true},
+		"GET /v1/gauge/sources/{repo=**}":          reads("gauge.profiles"),
+		"POST /v1/gauge/sources/{repo=**}:settle":  reads("gauge.profiles"),
+		"/gauge.v1.GaugeService/ListProfiles":      reads("gauge.profiles"),
+	}}
+	read := []*basev0.WorkScopeV1{ws("gauge.profiles", nil, "read")}
+	type want int
+	const (
+		allow want = iota
+		denied
+		missing
+	)
+	for _, tc := range []struct {
+		name, method string
+		held         []*basev0.WorkScopeV1
+		want         want
+		reason       string
+	}{
+		{"one resource", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, "read")}, allow, ""},
+		{"several resource scopes", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, "read"), ws("gauge.items", []string{"two"}, "read")}, allow, ""},
+		{"restricted wildcard", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, scope.AnyAction)}, allow, ""},
+		{"whole kind", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", nil, "read")}, allow, ""},
+		{"whole wildcard", "/gauge.Service/Edit", []*basev0.WorkScopeV1{ws("gauge.items", nil, scope.AnyAction)}, allow, ""},
+		{"whole read restricted write", "/gauge.Service/Edit", []*basev0.WorkScopeV1{ws("gauge.items", nil, "read"), ws("gauge.items", []string{"one"}, "write")}, allow, ""},
+		{"checked caller", "/gauge.Service/Ping", nil, allow, ""},
+		{"missing write names the restriction", "/gauge.Service/Edit", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, "read")}, denied, "resource-limited"},
+		{"nothing held", "/gauge.Service/List", nil, denied, "it holds nothing"},
+		{"owner-selected is named", "/gauge.Service/Edit", []*basev0.WorkScopeV1{{ResourceKind: "gauge.items", Actions: []string{"read"}, ResourceOwnerId: "p"}}, denied, "owner-selected"},
+		{"both requires and any caller", "/gauge.Service/Both", read, denied, "both that it requires"},
+		{"a policy declaring nothing", "/gauge.Service/Empty", read, denied, "declares no policy"},
+		{"an undeclared method", "/gauge.Service/Gone", read, missing, "serves no method"},
+		{"route", "GET /v1/gauge/profiles", read, allow, ""},
+		{"route template", "GET /v1/gauge/profiles/pro-1", read, allow, ""},
+		{"route matched, write not held", "POST /v1/gauge/matches/m-1:settle", read, denied, "gauge.profiles:write"},
+		{"extra segment", "GET /v1/gauge/profiles/pro-1/extra", read, missing, ""},
+		{"other verb", "DELETE /v1/gauge/profiles/pro-1", read, missing, ""},
+		{"an empty segment", "POST /v1/gauge/matches/:settle", read, missing, ""},
+		{"two templates match", "GET /v1/gauge/ambiguous/x", read, denied, "more than one declared route"},
+		{"rest of path", "GET /v1/gauge/sources/github.com/acme/repo", read, allow, ""},
+		{"empty rest of path", "GET /v1/gauge/sources/", read, missing, ""},
+		{"verb after the rest", "POST /v1/gauge/sources/github.com/acme/repo:settle", read, allow, ""},
+		{"HTTP never borrows a protobuf policy", "POST /gauge.v1.GaugeService/ListProfiles", read, missing, ""},
+		{"a procedure", "/gauge.v1.GaugeService/ListProfiles", read, allow, ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := decide.AdmitMethod(gauge, tc.method, tc.held)
+			switch tc.want {
+			case allow:
+				if err != nil {
+					t.Fatal(err)
+				}
+				return
+			case denied:
+				wantCode(t, err, domain.Denied)
+			case missing:
+				wantCode(t, err, domain.NotFound)
+			}
+			if !strings.Contains(err.Error(), tc.reason) {
+				t.Fatalf("refusal %q does not name %q", err, tc.reason)
+			}
+		})
+	}
+	t.Run("a module declaring no method policy admits nothing", func(t *testing.T) {
+		err := decide.AdmitMethod(domain.Module{Principal: "oracle"}, "/oracle/Read", read)
+		wantCode(t, err, domain.Denied)
+		if !strings.Contains(err.Error(), "no method policy") {
+			t.Fatal(err)
+		}
+	})
+}
+
+func wantCode(t *testing.T, err error, want domain.Code) {
+	t.Helper()
+	if got, ok := domain.CodeOf(err); !ok || got != want {
+		t.Fatalf("want code %v, got %v (%v)", want, got, err)
+	}
+}
+
+// A delivery never selects an owner: anywhere one appears is refused by name,
+// and what a module serves includes every kind its methods require.
+func TestADeliveryNamesNoOwnerAndServesWhatItsMethodsRequire(t *testing.T) {
+	owner := &basev0.WorkScopeV1{ResourceKind: "k", Actions: []string{"read"}, ResourceOwnerId: "u"}
+	base := func() domain.Module {
+		return domain.Module{Name: "m", Principal: "m", Kind: domain.KindModule, Generation: 1, Bindings: map[string]domain.Binding{}}
+	}
+	for name, mutate := range map[string]func(*domain.Module){
+		"serves": func(m *domain.Module) { m.ResourceKinds = []*basev0.WorkScopeV1{owner} },
+		"invoke": func(m *domain.Module) {
+			m.Bindings["b"] = domain.Binding{ID: "b", Audience: "x", InvokeScopes: []*basev0.WorkScopeV1{owner}}
+		},
+		"lookup": func(m *domain.Module) {
+			m.Bindings["b"] = domain.Binding{ID: "b", Audience: "x", InvokeScopes: []*basev0.WorkScopeV1{ws("k", nil, "read")}, LookupScopes: []*basev0.WorkScopeV1{owner}}
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			m := base()
+			mutate(&m)
+			err := decide.ValidateModule(m)
+			wantCode(t, err, domain.Denied)
+			if !strings.Contains(err.Error(), "never selects an owner") {
+				t.Fatal(err)
+			}
+		})
+	}
+	m := base()
+	m.ResourceKinds = []*basev0.WorkScopeV1{ws("own", nil, "read")}
+	m.Methods = map[string]domain.MethodPolicy{"/m/Write": {Requires: []*basev0.WorkScopeV1{ws("other", nil, "write")}}, "/m/Read": reads("own")}
+	served := decide.Served(m)
+	if !scope.Same(served, scope.Normalize([]*basev0.WorkScopeV1{ws("other", nil, "write"), ws("own", nil, "read")})) {
+		t.Fatalf("served %v", served)
+	}
+}
diff --git a/libraries/authority-core/go/decide/org_scopes_test.go b/libraries/authority-core/go/decide/org_scopes_test.go
new file mode 100644
index 00000000..20d8070a
--- /dev/null
+++ b/libraries/authority-core/go/decide/org_scopes_test.go
@@ -0,0 +1,159 @@
+package decide_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	resources "github.com/codefly-dev/authority/libraries/resources/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+var store = domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule,
+	ResourceKinds: []*basev0.WorkScopeV1{sc("collection", "read", "write"), sc("note", "read")}}
+
+func role(scopes ...domain.RoleScope) []domain.OrgRole {
+	return []domain.OrgRole{{Organization: "acme", Name: "r", Scopes: scopes}}
+}
+
+func collectionRead(grants ...resources.Grant) domain.RoleScope {
+	return domain.RoleScope{Kind: "collection", Actions: []string{"read"}, Resources: grants}
+}
+
+func ids(actions []string, of ...string) []*basev0.WorkScopeV1 {
+	return []*basev0.WorkScopeV1{owned("collection", "", actions, of...)}
+}
+
+func same(t *testing.T, got, want []*basev0.WorkScopeV1) {
+	t.Helper()
+	if !scope.Same(got, scope.Normalize(want)) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+// A role naming resources by id holds exactly those ids: an empty ask is
+// issued on them, never on the whole kind.
+func TestAResourceScopedRoleHoldsExactlyItsIDs(t *testing.T) {
+	held := decide.OrgScopes(role(collectionRead(resources.Grant{ID: "store-x"}, resources.Grant{ID: "store-z"})), store, nil)
+	same(t, held, ids([]string{"read"}, "store-x", "store-z"))
+	issued, err := decide.Issue(nil, held)
+	if err != nil {
+		t.Fatal(err)
+	}
+	same(t, issued, ids([]string{"read"}, "store-x", "store-z"))
+	if issued, err = decide.Issue(ids([]string{"read"}, "store-x"), held); err != nil {
+		t.Fatal(err)
+	}
+	same(t, issued, ids([]string{"read"}, "store-x"))
+}
+
+// An ask naming any id the role does not select, or the whole kind, is
+// refused by name, even beside an id it does select.
+func TestAnAskBeyondARolesIDsIsRefused(t *testing.T) {
+	roles := role(collectionRead(resources.Grant{ID: "store-x"}))
+	for name, ask := range map[string][]*basev0.WorkScopeV1{
+		"another id":         ids([]string{"read"}, "store-y"),
+		"a held and another": ids([]string{"read"}, "store-x", "store-y"),
+		"the whole kind":     {sc("collection", "read")},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+			refused(t, err, domain.Denied, "widens")
+		})
+	}
+}
+
+// A hop's ceiling is what the person holds now, read against its ask and its
+// parent's ids: a child naming an id the person does not hold is not within it.
+func TestAChildCannotWidenAResourceScopedRole(t *testing.T) {
+	roles := role(collectionRead(resources.Grant{ID: "store-x"}))
+	parent, _ := decide.Issue(nil, decide.OrgScopes(roles, store, nil))
+	for _, ask := range [][]*basev0.WorkScopeV1{ids([]string{"read"}, "store-y"), {sc("collection", "read")}} {
+		ceiling := scope.Intersect(decide.OrgScopes(roles, store, append(ask, parent...)), parent)
+		if scope.Attenuates(ask, ceiling) {
+			t.Fatalf("a child asking %v is within %v", ask, ceiling)
+		}
+	}
+	same(t, scope.Intersect(decide.OrgScopes(roles, store, parent), parent), ids([]string{"read"}, "store-x"))
+}
+
+// A token cannot carry a prefix or a pattern, so neither ever holds the whole
+// kind: it holds only the ids an ask (or a parent) names that it matches. An
+// empty ask therefore carries none of it; this is the fail-closed choice, and
+// a person holding nothing else is refused by name.
+func TestAPatternOrPrefixRoleFailsClosed(t *testing.T) {
+	roles := role(collectionRead(resources.Grant{Prefix: "derived/"}, resources.Grant{Pattern: "shared-[a-z]+"}))
+	held := decide.OrgScopes(roles, store, nil)
+	if len(held) != 0 {
+		t.Fatalf("an empty ask holds %v of a pattern", held)
+	}
+	_, err := decide.Issue(nil, held)
+	refused(t, err, domain.Denied, "holds nothing")
+
+	ask := ids([]string{"read"}, "derived/wiki", "shared-finance")
+	issued, err := decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+	if err != nil {
+		t.Fatal(err)
+	}
+	same(t, issued, ask)
+
+	ask = ids([]string{"read"}, "shared-finance", "finance")
+	_, err = decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+	refused(t, err, domain.Denied, "widens")
+
+	ask = []*basev0.WorkScopeV1{sc("collection", "read")}
+	_, err = decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+	refused(t, err, domain.Denied, "beyond")
+
+	// Ids named on another kind are not this kind's.
+	if held := decide.OrgScopes(roles, store, []*basev0.WorkScopeV1{owned("note", "", []string{"read"}, "shared-finance")}); len(held) != 0 {
+		t.Fatalf("a pattern holds %v from another kind's ids", held)
+	}
+	// Beside an id matcher, an empty ask carries the id alone.
+	same(t, decide.OrgScopes(role(collectionRead(resources.Grant{Pattern: "shared-[a-z]+"}, resources.Grant{ID: "store-x"})), store, nil), ids([]string{"read"}, "store-x"))
+	// A matcher that does not compile holds nothing.
+	if held := decide.OrgScopes(role(collectionRead(resources.Grant{Pattern: "(a"})), store, ask); len(held) != 0 {
+		t.Fatalf("an invalid matcher holds %v", held)
+	}
+}
+
+// A role naming no resource, or every resource, holds the whole kind as before.
+func TestAWholeKindRoleIsUnchanged(t *testing.T) {
+	for name, scopes := range map[string]domain.RoleScope{
+		"no matcher":    collectionRead(),
+		"all":           collectionRead(resources.Grant{All: true}),
+		"all and an id": collectionRead(resources.Grant{ID: "store-x"}, resources.Grant{All: true}),
+	} {
+		t.Run(name, func(t *testing.T) {
+			held := decide.OrgScopes(role(scopes), store, nil)
+			same(t, held, []*basev0.WorkScopeV1{sc("collection", "read")})
+			issued, err := decide.Issue(nil, held)
+			if err != nil {
+				t.Fatal(err)
+			}
+			same(t, issued, []*basev0.WorkScopeV1{sc("collection", "read")})
+		})
+	}
+}
+
+// One role holding the whole kind and another an id of it, for the same
+// action: the person holds the whole kind, whichever comes first.
+func TestAWholeKindRoleAbsorbsAResourceScopedOne(t *testing.T) {
+	whole, scoped := collectionRead(), collectionRead(resources.Grant{ID: "store-x"})
+	for _, roles := range [][]domain.OrgRole{
+		{{Name: "a", Scopes: []domain.RoleScope{whole}}, {Name: "b", Scopes: []domain.RoleScope{scoped}}},
+		{{Name: "b", Scopes: []domain.RoleScope{scoped}}, {Name: "a", Scopes: []domain.RoleScope{whole}}},
+	} {
+		same(t, decide.OrgScopes(roles, store, nil), []*basev0.WorkScopeV1{sc("collection", "read")})
+	}
+	// A different action keeps its own ids.
+	writes := domain.RoleScope{Kind: "collection", Actions: []string{"write"}, Resources: []resources.Grant{{ID: "store-x"}}}
+	same(t, decide.OrgScopes(role(whole, writes), store, nil), []*basev0.WorkScopeV1{sc("collection", "read"), owned("collection", "", []string{"write"}, "store-x")})
+}
+
+// A role scope on every kind naming an id holds that id on each served kind.
+func TestAnAnyKindRoleNamingIDsHoldsThemOnEachKind(t *testing.T) {
+	held := decide.OrgScopes(role(domain.RoleScope{Kind: scope.AnyKind, Actions: []string{"read"}, Resources: []resources.Grant{{ID: "x"}}}), store, nil)
+	same(t, held, []*basev0.WorkScopeV1{owned("collection", "", []string{"read"}, "x"), owned("note", "", []string{"read"}, "x")})
+}
diff --git a/libraries/authority-core/go/delivered/delivered.go b/libraries/authority-core/go/delivered/delivered.go
new file mode 100644
index 00000000..69590154
--- /dev/null
+++ b/libraries/authority-core/go/delivered/delivered.go
@@ -0,0 +1,217 @@
+// Package delivered reads a verified delivery as the authority's module: core's
+// signed module manifest and, beside it, the authority's own document
+// (codefly.dev/composition AuthorityManifestV1). Every host composes a module
+// from the same two documents, so this is where the reading lives; a host
+// verifies the carrier (it holds the release keys) and decodes the document
+// from its own generated binding into Document, and nothing else.
+package delivered
+
+import (
+	"crypto"
+	"slices"
+	"strings"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/codefly-dev/core/solutionhost"
+)
+
+// Scopes is a scope list.
+type Scopes = []*basev0.WorkScopeV1
+
+// Document is the authority's own document delivered with a manifest, as a
+// host decodes it.
+type Document struct {
+	Module             string
+	Generation         uint64
+	CoreManifestDigest string
+	ScopeCeilings      Scopes
+	Methods            []Method
+	Roles              []Role
+	OwnerAware         bool
+}
+
+// Method is one method's declaration in the document.
+type Method struct {
+	Method           string
+	Requires         Scopes
+	AnyCheckedCaller bool
+}
+
+// Role is one of a solution's roles: its scopes, and those it declares
+// installation-owned (resolved to the ids each installation owns).
+type Role struct {
+	Name                      string
+	Scopes, InstallationOwned Scopes
+}
+
+// VerifyDocument checks the document's signature against the pinned release
+// keys and that the key which signed it is the one that signed the carrier, so
+// a delivery cannot pair one release's manifest with another's declarations.
+func VerifyDocument(document, envelope []byte, keys map[string]crypto.PublicKey, carrierSigner string) error {
+	keyID, err := delivery.Verify(document, envelope, keys)
+	if err != nil {
+		return domain.Refuse("the authority's document does not verify: %v", err)
+	}
+	if keyID != carrierSigner {
+		return domain.Refuse("the authority's document is signed by %q and the manifest by %q", keyID, carrierSigner)
+	}
+	return nil
+}
+
+// Pair holds a verified document to the carrier it was delivered with: the
+// same module, the same generation, and the carrier's own digest.
+func Pair(doc Document, carrierDocument []byte, manifest *solutionhost.ModuleManifest) error {
+	switch {
+	case doc.Module != manifest.Alias:
+		return domain.Refuse("the authority's document is for %q, the manifest for %q", doc.Module, manifest.Alias)
+	case doc.Generation != manifest.Generation:
+		return domain.Refuse("the authority's document is at generation %d, the manifest at %d", doc.Generation, manifest.Generation)
+	case doc.CoreManifestDigest != delivery.Digest(carrierDocument):
+		return domain.Refuse("the authority's document names another manifest than the one delivered with it")
+	}
+	return nil
+}
+
+// Module is what a verified delivery composes: core's manifest (FromCore),
+// narrowed and completed by the document paired with it, when one was. A
+// withdrawal carries no live declaration.
+func Module(manifest *solutionhost.ModuleManifest, doc *Document) (domain.Module, error) {
+	m := FromCore(manifest)
+	if doc == nil {
+		return m, nil
+	}
+	if manifest.Removed && (len(doc.Methods) > 0 || len(doc.Roles) > 0 || len(doc.ScopeCeilings) > 0) {
+		return m, domain.Malformed("a withdrawal carries no live authority declarations")
+	}
+	var err error
+	if m.Methods, err = methods(doc.Methods); err != nil {
+		return m, err
+	}
+	for _, ceiling := range doc.ScopeCeilings {
+		if ceiling.GetResourceOwnerId() != "" {
+			return m, domain.Refuse("%s: scope ceiling %s names resource owner %q; a delivery never selects an owner", m.Name, ceiling.GetResourceKind(), ceiling.GetResourceOwnerId())
+		}
+	}
+	if m, err = Ceiled(m, doc.ScopeCeilings); err != nil {
+		return m, err
+	}
+	if m.Roles, m.OwnedRoles, err = roles(doc.Roles); err != nil {
+		return m, err
+	}
+	m.OwnerAware = doc.OwnerAware
+	return m, nil
+}
+
+// methods reads what each method declares.
+func methods(in []Method) (map[string]domain.MethodPolicy, error) {
+	out := make(map[string]domain.MethodPolicy, len(in))
+	for _, method := range in {
+		if _, twice := out[method.Method]; twice || method.Method == "" {
+			return nil, domain.Malformed("the authority's document lists method %q twice or unnamed", method.Method)
+		}
+		out[method.Method] = domain.MethodPolicy{Requires: method.Requires, AnyCheckedCaller: method.AnyCheckedCaller}
+	}
+	return out, nil
+}
+
+// roles reads the roles a solution declares, by name, and the scopes of each
+// it declares installation-owned. Core holds them to the role contract when
+// the module is applied (decide.ValidateModule).
+func roles(in []Role) (map[string]Scopes, map[string]Scopes, error) {
+	owned := map[string]Scopes{}
+	if len(in) == 0 {
+		return nil, owned, nil
+	}
+	out := make(map[string]Scopes, len(in))
+	for _, role := range in {
+		if _, twice := out[role.Name]; twice || role.Name == "" {
+			return nil, nil, domain.Malformed("the authority's document lists role %q twice or unnamed", role.Name)
+		}
+		out[role.Name] = scope.Normalize(role.Scopes)
+		if len(role.InstallationOwned) > 0 {
+			owned[role.Name] = role.InstallationOwned
+		}
+	}
+	return out, owned, nil
+}
+
+// Ceiled gives each of the module's own kinds the actions its document
+// declares on it, in place of the any-action kind core's manifest leaves it
+// with. A ceiling naming a kind core's manifest does not declare is refused:
+// the document narrows what core's manifest composes, never adds to it.
+func Ceiled(m domain.Module, ceilings Scopes) (domain.Module, error) {
+	if len(ceilings) == 0 {
+		return m, nil
+	}
+	declared := map[string]bool{}
+	for _, kind := range m.ResourceKinds {
+		declared[kind.GetResourceKind()] = true
+	}
+	ceiled := map[string]bool{}
+	for _, ceiling := range ceilings {
+		if !declared[ceiling.GetResourceKind()] {
+			return m, domain.Malformed("the authority's document ceils %s, which %s's manifest does not declare", ceiling.GetResourceKind(), m.Name)
+		}
+		if len(ceiling.GetActions()) == 0 {
+			return m, domain.Malformed("the authority's document ceils %s with no action", ceiling.GetResourceKind())
+		}
+		ceiled[ceiling.GetResourceKind()] = true
+	}
+	kinds := slices.Clone(ceilings)
+	for _, kind := range m.ResourceKinds {
+		if !ceiled[kind.GetResourceKind()] {
+			kinds = append(kinds, kind)
+		}
+	}
+	m.ResourceKinds = scope.Normalize(kinds)
+	return m, nil
+}
+
+// FromCore reads core's module manifest as the authority's module. Core's
+// manifest carries no roles; a solution's arrive in the document delivered
+// with it. The manifest is the ceiling here: a resource kind declared with no
+// actions serves whatever the roles grant on it, a binding's operations are
+// its scopes, each "<resource kind>:<action>" as core's manifest writes them.
+func FromCore(in *solutionhost.ModuleManifest) domain.Module {
+	m := domain.Module{Name: in.Alias, Principal: in.Alias, Kind: string(in.Kind), Generation: in.Generation, Bindings: map[string]domain.Binding{}}
+	if in.Authority == nil {
+		return m
+	}
+	if in.Authority.Principal != "" {
+		m.Principal = in.Authority.Principal
+	}
+	for _, kind := range in.Authority.ResourceKinds {
+		m.ResourceKinds = append(m.ResourceKinds, &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{scope.AnyAction}})
+	}
+	m.ResourceKinds = scope.Normalize(m.ResourceKinds)
+	for _, b := range in.Authority.Bindings {
+		m.Bindings[b.ID] = domain.Binding{ID: b.ID, Audience: b.Audience, InvokeScopes: scopesOf(b.Operations["invoke"]),
+			HeadlessScopes: scopesOf(b.Operations["headless"]), LookupScopes: scopesOf(b.Operations["lookup"])}
+	}
+	return m
+}
+
+// scopesOf reads one operation's scopes, grouped by kind. An entry without a
+// colon names nothing and is skipped; the manifest's own validation refuses it.
+func scopesOf(entries []string) Scopes {
+	byKind := map[string][]string{}
+	var kinds []string
+	for _, entry := range entries {
+		kind, action, ok := strings.Cut(entry, ":")
+		if !ok || kind == "" || action == "" {
+			continue
+		}
+		if _, seen := byKind[kind]; !seen {
+			kinds = append(kinds, kind)
+		}
+		byKind[kind] = append(byKind[kind], action)
+	}
+	var out Scopes
+	for _, kind := range kinds {
+		out = append(out, &basev0.WorkScopeV1{ResourceKind: kind, Actions: byKind[kind]})
+	}
+	return scope.Normalize(out)
+}
diff --git a/libraries/authority-core/go/delivered/delivered_test.go b/libraries/authority-core/go/delivered/delivered_test.go
new file mode 100644
index 00000000..911d3e24
--- /dev/null
+++ b/libraries/authority-core/go/delivered/delivered_test.go
@@ -0,0 +1,171 @@
+package delivered_test
+
+import (
+	"crypto"
+	"crypto/ed25519"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/delivered"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/codefly-dev/core/solutionhost"
+)
+
+func ws(kind string, actions ...string) *basev0.WorkScopeV1 {
+	return &basev0.WorkScopeV1{ResourceKind: kind, Actions: actions}
+}
+
+func code(t *testing.T, err error, want domain.Code) {
+	t.Helper()
+	if got, ok := domain.CodeOf(err); !ok || got != want {
+		t.Fatalf("want code %v, got %v (%v)", want, got, err)
+	}
+}
+
+// Core's manifest writes a binding's operations as operation → "<kind>:<action>"
+// entries; they are read as invoke, headless and lookup scopes.
+func TestCoreBindingOperationsAreReadAsScopesPerOperation(t *testing.T) {
+	m := delivered.FromCore(&solutionhost.ModuleManifest{Alias: "robin", Kind: solutionhost.KindModule, Generation: 3,
+		Authority: &solutionhost.Authority{Principal: "robin-principal", ResourceKinds: []string{"robin.chat"}, Bindings: []solutionhost.AuthorityBinding{{
+			ID: "model", Audience: "model",
+			Operations: map[string][]string{
+				"invoke":   {"modelservice.profiles:invoke", "modelservice.profiles:read", "malformed"},
+				"lookup":   {"modelservice.profiles:read"},
+				"headless": {"modelservice.profiles:read"},
+			},
+		}}}})
+	if m.Name != "robin" || m.Principal != "robin-principal" || m.Kind != domain.KindModule || m.Generation != 3 {
+		t.Fatalf("module %+v", m)
+	}
+	if !scope.Same(m.ResourceKinds, scope.Normalize([]*basev0.WorkScopeV1{ws("robin.chat", scope.AnyAction)})) {
+		t.Fatalf("a declared kind serves any action until ceiled: %v", m.ResourceKinds)
+	}
+	b := m.Bindings["model"]
+	if b.Audience != "model" || !scope.Same(b.InvokeScopes, scope.Normalize([]*basev0.WorkScopeV1{ws("modelservice.profiles", "invoke", "read")})) ||
+		!scope.Same(b.HeadlessScopes, scope.Normalize([]*basev0.WorkScopeV1{ws("modelservice.profiles", "read")})) || !scope.Same(b.LookupScopes, b.HeadlessScopes) {
+		t.Fatalf("binding %+v", b)
+	}
+	if bare := delivered.FromCore(&solutionhost.ModuleManifest{Alias: "bare", Generation: 1}); bare.Principal != "bare" || len(bare.Bindings) != 0 {
+		t.Fatalf("a manifest without authority composes its alias alone: %+v", bare)
+	}
+}
+
+func TestScopeCeilingsGiveTheModulesKindsTheirActions(t *testing.T) {
+	m := delivered.FromCore(&solutionhost.ModuleManifest{Alias: "runtime", Kind: solutionhost.KindModule, Generation: 1,
+		Authority: &solutionhost.Authority{Principal: "runtime", ResourceKinds: []string{"runtime.tasks", "runtime.queues"}}})
+	got, err := delivered.Ceiled(m, []*basev0.WorkScopeV1{ws("runtime.tasks", "start", "execute")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !scope.Same(got.ResourceKinds, scope.Normalize([]*basev0.WorkScopeV1{ws("runtime.tasks", "execute", "start"), ws("runtime.queues", scope.AnyAction)})) {
+		t.Fatalf("served %v", got.ResourceKinds)
+	}
+	for name, ceilings := range map[string][]*basev0.WorkScopeV1{
+		"a kind core does not declare": {ws("records.records", "write")},
+		"a kind with no action":        {ws("runtime.tasks")},
+	} {
+		_, err := delivered.Ceiled(m, ceilings)
+		code(t, err, domain.Invalid)
+		if !strings.Contains(err.Error(), "ceils") {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+}
+
+func solutionManifest() *solutionhost.ModuleManifest {
+	return &solutionhost.ModuleManifest{Alias: "pages", Kind: solutionhost.KindSolution, Generation: 2,
+		Authority: &solutionhost.Authority{Principal: "pages", ResourceKinds: []string{"pages.page"}}}
+}
+
+func TestADocumentCompletesTheModule(t *testing.T) {
+	doc := &delivered.Document{Module: "pages", Generation: 2, OwnerAware: true,
+		ScopeCeilings: []*basev0.WorkScopeV1{ws("pages.page", "read", "write")},
+		Methods:       []delivered.Method{{Method: "GET /p/{id}", Requires: []*basev0.WorkScopeV1{ws("pages.page", "read")}}, {Method: "/x/Ping", AnyCheckedCaller: true}},
+		Roles: []delivered.Role{{Name: "installer", Scopes: []*basev0.WorkScopeV1{ws("pages.page", "write", "read")}},
+			{Name: "viewer", Scopes: []*basev0.WorkScopeV1{ws("pages.page", "read")}, InstallationOwned: []*basev0.WorkScopeV1{ws("store.item", "read")}}},
+	}
+	m, err := delivered.Module(solutionManifest(), doc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !m.OwnerAware || len(m.Methods) != 2 || !m.Methods["/x/Ping"].AnyCheckedCaller || len(m.Roles) != 2 ||
+		!slices.Equal(m.Roles["installer"][0].GetActions(), []string{"read", "write"}) || len(m.OwnedRoles["viewer"]) != 1 || len(m.OwnedRoles["installer"]) != 0 {
+		t.Fatalf("module %+v", m)
+	}
+	if !scope.Same(m.ResourceKinds, scope.Normalize([]*basev0.WorkScopeV1{ws("pages.page", "read", "write")})) {
+		t.Fatalf("served %v", m.ResourceKinds)
+	}
+	plain, err := delivered.Module(solutionManifest(), nil)
+	if err != nil || plain.Roles != nil || plain.OwnerAware {
+		t.Fatalf("no document: %+v %v", plain, err)
+	}
+}
+
+func TestADocumentIsRefusedByName(t *testing.T) {
+	removed := solutionManifest()
+	removed.Removed = true
+	for _, tc := range []struct {
+		name     string
+		manifest *solutionhost.ModuleManifest
+		doc      delivered.Document
+		code     domain.Code
+		reason   string
+	}{
+		{"a method twice", solutionManifest(), delivered.Document{Methods: []delivered.Method{{Method: "/a"}, {Method: "/a"}}}, domain.Invalid, "twice or unnamed"},
+		{"an unnamed method", solutionManifest(), delivered.Document{Methods: []delivered.Method{{}}}, domain.Invalid, "twice or unnamed"},
+		{"a role twice", solutionManifest(), delivered.Document{Roles: []delivered.Role{{Name: "r"}, {Name: "r"}}}, domain.Invalid, "twice or unnamed"},
+		{"a ceiling naming an owner", solutionManifest(), delivered.Document{ScopeCeilings: []*basev0.WorkScopeV1{{ResourceKind: "pages.page", Actions: []string{"read"}, ResourceOwnerId: "u"}}}, domain.Denied, "never selects an owner"},
+		{"a withdrawal declaring roles", removed, delivered.Document{Roles: []delivered.Role{{Name: "installer"}}}, domain.Invalid, "withdrawal"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := delivered.Module(tc.manifest, &tc.doc)
+			code(t, err, tc.code)
+			if !strings.Contains(err.Error(), tc.reason) {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+// A document is signed by the key that signed the carrier, and names the
+// carrier's module, generation and digest.
+func TestADocumentIsPairedWithItsCarrier(t *testing.T) {
+	public, private, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, otherPrivate, _ := ed25519.GenerateKey(nil)
+	sign := func(key ed25519.PrivateKey) func([]byte) ([]byte, error) {
+		return func(b []byte) ([]byte, error) { return ed25519.Sign(key, b), nil }
+	}
+	keys := map[string]crypto.PublicKey{"release": public}
+	document := []byte("the authority's document")
+	envelope, err := delivery.Sign(document, "release", sign(private))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := delivered.VerifyDocument(document, envelope, keys, "release"); err != nil {
+		t.Fatal(err)
+	}
+	code(t, delivered.VerifyDocument(document, envelope, keys, "another"), domain.Denied)
+	forged, _ := delivery.Sign(document, "release", sign(otherPrivate))
+	code(t, delivered.VerifyDocument(document, forged, keys, "release"), domain.Denied)
+
+	carrier := []byte("core's manifest")
+	m := solutionManifest()
+	good := delivered.Document{Module: "pages", Generation: 2, CoreManifestDigest: delivery.Digest(carrier)}
+	if err := delivered.Pair(good, carrier, m); err != nil {
+		t.Fatal(err)
+	}
+	for name, doc := range map[string]delivered.Document{
+		"another module":     {Module: "other", Generation: 2, CoreManifestDigest: good.CoreManifestDigest},
+		"another generation": {Module: "pages", Generation: 1, CoreManifestDigest: good.CoreManifestDigest},
+		"another manifest":   {Module: "pages", Generation: 2, CoreManifestDigest: delivery.Digest([]byte("other"))},
+	} {
+		t.Run(name, func(t *testing.T) { code(t, delivered.Pair(doc, carrier, m), domain.Denied) })
+	}
+}
diff --git a/libraries/authority-core/go/domain/domain.go b/libraries/authority-core/go/domain/domain.go
index b7fb1dca..31aa67cd 100644
--- a/libraries/authority-core/go/domain/domain.go
+++ b/libraries/authority-core/go/domain/domain.go
@@ -154,6 +154,10 @@ func (r *Refusal) Unwrap() error { return r.Cause }
 // ErrNoInstallerRole names a solution that declares no installer role.
 var ErrNoInstallerRole = errors.New("a solution declares an installer role")
 
+// ErrAlreadyInstalled names an install of a target its organization holds
+// active already.
+var ErrAlreadyInstalled = errors.New("already installed")
+
 // ErrNotFound is what a store answers for a missing record.
 var ErrNotFound = errors.New("not found")
 
@@ -194,3 +198,36 @@ type ConsentReceipt struct {
 	OperationID, Intent string
 	Revision            uint64
 }
+
+// EventKind names one change of authority the core makes.
+type EventKind string
+
+// The changes a host journals.
+const (
+	ModuleApplied           EventKind = "module.applied"
+	ModuleWithdrawn         EventKind = "module.withdrawn"
+	InstallationRequested   EventKind = "installation.requested"
+	InstallationActivated   EventKind = "installation.activated"
+	InstallationUninstalled EventKind = "installation.uninstalled"
+	RoleGranted             EventKind = "role.granted"
+	RoleRevoked             EventKind = "role.revoked"
+	DelegationGranted       EventKind = "delegation.granted"
+	DelegationRevoked       EventKind = "delegation.revoked"
+	ResourceAttached        EventKind = "resource.attached"
+	ResourceDetached        EventKind = "resource.detached"
+	ResourceTransferred     EventKind = "resource.transferred"
+)
+
+// Event is one change of authority, journaled by the host in the transaction
+// that makes it: the journal and the change commit together or not at all.
+type Event struct {
+	Kind EventKind
+	// Organization is where it happened; empty for a module's delivery.
+	Organization string
+	// Actor is the person who acted, or the module whose workload did; empty
+	// for the host's own setup and a delivery.
+	Actor string
+	// Subject is what changed: an installation, a delegation, a module.
+	Subject string
+	Detail  map[string]string
+}
diff --git a/libraries/authority-core/go/go.mod b/libraries/authority-core/go/go.mod
index 9ad50f8f..d9ae5158 100644
--- a/libraries/authority-core/go/go.mod
+++ b/libraries/authority-core/go/go.mod
@@ -4,6 +4,7 @@ go 1.27.3
 
 require (
 	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93
+	github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026193714-49101ae11a7f
 	github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93
 	github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2
 	github.com/google/uuid v1.6.0
@@ -15,10 +16,43 @@ require (
 	buf.build/go/protovalidate v1.4.0 // indirect
 	cel.dev/cel-go v0.32.0 // indirect
 	cel.dev/expr v0.25.3 // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/go-openapi/analysis v1.0.0 // indirect
+	github.com/go-openapi/errors v0.22.9 // indirect
+	github.com/go-openapi/jsonpointer v1.0.1 // indirect
+	github.com/go-openapi/jsonreference v1.0.2 // indirect
+	github.com/go-openapi/loads v0.25.3 // indirect
+	github.com/go-openapi/spec v1.0.1 // indirect
+	github.com/go-openapi/strfmt v0.27.2 // indirect
+	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
+	github.com/go-openapi/swag/loading v0.29.2 // indirect
+	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/pools v0.29.2 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/gofrs/flock v0.13.1 // indirect
+	github.com/google/go-github/v89 v89.0.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/oklog/ulid/v2 v2.1.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
+	github.com/yoheimuta/go-protoparser/v4 v4.14.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 // indirect
+	google.golang.org/grpc v1.84.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/libraries/authority-core/go/go.sum b/libraries/authority-core/go/go.sum
index dff267a3..f1dc59c3 100644
--- a/libraries/authority-core/go/go.sum
+++ b/libraries/authority-core/go/go.sum
@@ -6,33 +6,230 @@ cel.dev/cel-go v0.32.0 h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
 cel.dev/cel-go v0.32.0/go.mod h1:DnVip7tpJSsgZymwfT+m1tnEVy3ivAjSMXPx12YrMkU=
 cel.dev/expr v0.25.3 h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
 cel.dev/expr v0.25.3/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
+github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4=
 github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
+github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93 h1:PnhgA9wkib67bJnc5hkhkc80J2ch5uYiq+9/NiD/XFU=
 github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93/go.mod h1:XsOFnO2MQdr37vM3ULa0Uwi8ZWptyVx7hRSUyIdaZ1Q=
+github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026193714-49101ae11a7f h1:oobjjGqbBaFjYLPYculFD74BOdN5+UZ6eyYl6mOsT7I=
+github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026193714-49101ae11a7f/go.mod h1:NqCbvIWbkbCzSpUUYQjP8Jv+LpFnDRbVhPdAj67DHhE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 h1:4EygH7/J0E6aM7hUPdbQGfit1rsLUNCtWJ8kMh2b9PE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2 h1:I1wL0ANXhTdQuEAnxXF+s4+rKILlBu/QHILq4Skyi3I=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2/go.mod h1:1ina3kP+YSAL4tlZvnEYd4P8bFGnJECfkP86ojeeF1A=
+github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
+github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.8.2 h1:9d9DEokx5W7qlr0shkFXIxEA7+TTD+llwzcykSlxMNc=
+github.com/docker/go-connections v0.8.2/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
+github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-openapi/analysis v1.0.0 h1:sNvbAGCJqUTqIAodr9IVqJMmuZas3YS9ms1dGK9yiJ4=
+github.com/go-openapi/analysis v1.0.0/go.mod h1:NhYjJ57fnE+bcE7UwrJyMkhWA3Dfz7TdiBfTVAnos4Y=
+github.com/go-openapi/errors v0.22.9 h1:HI9+SyVYiRzyeBQGv0CbWbQa+u2S0nny7G7AhY+UMiM=
+github.com/go-openapi/errors v0.22.9/go.mod h1:R73q66sXP2smzAGgFOI4nqtusRK2xN5pYCjsij+KX58=
+github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg=
+github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY=
+github.com/go-openapi/jsonreference v1.0.2 h1:oS4et8FOf3p3UQxEo4Xt0esijmBUM+F259Xl72OSZsc=
+github.com/go-openapi/jsonreference v1.0.2/go.mod h1:TbUNSOo+fcorZjFaNoiSDSoaNnnZtqJtLGR1PuvE/Cs=
+github.com/go-openapi/loads v0.25.3 h1:V+jKy/thXWdLJUuYC8sZX2dICyAa8M3DokF70jj34P0=
+github.com/go-openapi/loads v0.25.3/go.mod h1:LgLyCSOLBL2Qnj0Ps1oo2YH8jZoEKsMeVZCc+ALIxFo=
+github.com/go-openapi/spec v1.0.1 h1:lj2vdGpNDcVgwRc6qXdw6qt/KQpCtSa9tnUH6vpDPDk=
+github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV3H1fYw8=
+github.com/go-openapi/strfmt v0.27.2 h1:SG32SlbwNy92s0KJiVxt2joJeFdqIYHvwrA0OU6HqzQ=
+github.com/go-openapi/strfmt v0.27.2/go.mod h1:M4CKsMO0Fb8qR10+1Ra75wCKNNquy+Vj+4LWZrhTo2E=
+github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
+github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
+github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
+github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw=
+github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0=
+github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q=
+github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI=
+github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0=
+github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k=
+github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2/go.mod h1:HC2egPORFzbj/gf05Zrfgz8Mgplx3oW7hgGi7pjZVhM=
+github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJffsyJ2dVlY=
+github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI=
+github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog=
+github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8=
+github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8=
+github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE=
+github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c=
+github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc=
+github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk=
+github.com/go-openapi/swag/stringutils v0.29.2/go.mod h1:i9cdh7sGaa0nm3CqIvH5IM5h2QClk1wns2ktKeILvRI=
+github.com/go-openapi/swag/typeutils v0.29.2 h1:O7aVvkTs3pXwikgtrPLenigEMdQFgONKRooQA9pgf2I=
+github.com/go-openapi/swag/typeutils v0.29.2/go.mod h1:7+GDG+uz9Ke+eVt4rClZg7wklSDp8hT/mKNh/pC26TE=
+github.com/go-openapi/swag/yamlutils v0.29.2 h1:IFKFFeDnuIwzfsuWRQU+rI8iL3g4XyAYjV/RlnlxPLM=
+github.com/go-openapi/swag/yamlutils v0.29.2/go.mod h1:7MGqtcrK73sxQ4ceiyIf8qiXS/s09JLMdR5esK5euYQ=
+github.com/go-openapi/testify/enable/yaml/v2 v2.7.0 h1:wPW6YRgx3+SID1yUy/Xwa17L8kFEaEKod2VRbJDZNUs=
+github.com/go-openapi/testify/enable/yaml/v2 v2.7.0/go.mod h1:mI1M88etYbc3PhgHsWQK2kwvNwW5aGFqMPbmib+SGIs=
+github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho=
+github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
+github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
+github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e h1:Q6MvJtQK/iRcRtzAscm/zF23XxJlbECiGPyRicsX+Ak=
+github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
+github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
+github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/oklog/ulid/v2 v2.1.2 h1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=
+github.com/oklog/ulid/v2 v2.1.2/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8=
 github.com/rodaine/protogofakeit v0.1.1/go.mod h1:pXn/AstBYMaSfc1/RqH3N82pBuxtWgejz1AlYpY1mI0=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
+github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
+github.com/shoenig/go-m1cpu v0.2.1 h1:yqRB4fvOge2+FyRXFkXqsyMoqPazv14Yyy+iyccT2E4=
+github.com/shoenig/go-m1cpu v0.2.1/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
+github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
+github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
+github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/yoheimuta/go-protoparser/v4 v4.14.2 h1:/P/LlX1CF9NaTWEltGcIZVvNlPbhABuAnBtAWpb3+74=
+github.com/yoheimuta/go-protoparser/v4 v4.14.2/go.mod h1:AHNNnSWnb0UoL4QgHPiOAg2BniQceFscPI5X/BZNHl8=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 h1:Tq+E65HaNbZTeqcLw6QUhsV+/EIWdkfUH2CQzcrlE5M=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0/go.mod h1:A+EVhDakAj1waJBPhmTszZaSr08ww8MRRKy1nB1rqck=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
+go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU=
+go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
+go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw=
+go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
+go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU=
+go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
+go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b h1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=
+google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b/go.mod h1:9N4vtjEwvgQKEdlFVQO0M44ErhecQ9DCSQfGoZ51M6w=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 h1:QG6hS4zFplRZvOQedzei4t2pT/zkQc3VR1u+S9/rcAw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
+sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
+sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
+sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/libraries/authority-core/go/memstore/memstore.go b/libraries/authority-core/go/memstore/memstore.go
index f6fb428b..a058456f 100644
--- a/libraries/authority-core/go/memstore/memstore.go
+++ b/libraries/authority-core/go/memstore/memstore.go
@@ -21,9 +21,9 @@ import (
 type Store struct {
 	mu            sync.RWMutex
 	orgs          map[string]domain.Organization
-	people        map[string]domain.Person
-	roles         map[string]domain.OrgRole // organization/name
-	modules       map[string]domain.Module  // name
+	people        map[string]map[string]domain.Person // id → organization → membership
+	roles         map[string]domain.OrgRole           // organization/name
+	modules       map[string]domain.Module            // name
 	installations map[string]domain.Installation
 	grants        map[string][]domain.RoleGrant
 	revisions     map[string]uint64
@@ -37,7 +37,7 @@ type Store struct {
 // New is an empty store.
 func New() *Store {
 	return &Store{
-		orgs: map[string]domain.Organization{}, people: map[string]domain.Person{}, roles: map[string]domain.OrgRole{},
+		orgs: map[string]domain.Organization{}, people: map[string]map[string]domain.Person{}, roles: map[string]domain.OrgRole{},
 		modules: map[string]domain.Module{}, installations: map[string]domain.Installation{}, grants: map[string][]domain.RoleGrant{},
 		revisions: map[string]uint64{}, personEpochs: map[string]uint64{}, grantEpochs: map[string]uint64{},
 		ownerAware: map[string]uint64{}, delegations: map[string]domain.Delegation{}, tombstones: map[string]domain.Tombstone{},
@@ -109,20 +109,34 @@ func (s *Store) PutOrganization(o domain.Organization) {
 	s.orgs[o.ID] = o
 }
 
-// PutPerson records a person.
+// PutPerson records a person's membership of p.Organization; a person may
+// be a member of several organizations, each recorded by its own call.
 func (s *Store) PutPerson(p domain.Person) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.people[p.ID] = clonePerson(p)
+	if s.people[p.ID] == nil {
+		s.people[p.ID] = map[string]domain.Person{}
+	}
+	s.people[p.ID][p.Organization] = clonePerson(p)
 }
 
-// DeletePerson removes a person.
+// DeletePerson removes a person from every organization.
 func (s *Store) DeletePerson(id string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	delete(s.people, id)
 }
 
+// DeleteMember removes a person from one organization.
+func (s *Store) DeleteMember(organization, id string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.people[id], organization)
+	if len(s.people[id]) == 0 {
+		delete(s.people, id)
+	}
+}
+
 // PutOrgRole records an organization role.
 func (s *Store) PutOrgRole(r domain.OrgRole) {
 	s.mu.Lock()
@@ -160,18 +174,29 @@ func (t tx) Organization(id string) (domain.Organization, error) {
 	return o, nil
 }
 
+// Person answers a person by id: their membership of the first of their
+// organizations, by id. The authority reads only that the person exists.
 func (t tx) Person(id string) (domain.Person, error) {
-	p, ok := t.s.people[id]
+	memberships := t.s.people[id]
+	if len(memberships) == 0 {
+		return domain.Person{}, missing("person", id)
+	}
+	orgs := slices.Sorted(maps.Keys(memberships))
+	return clonePerson(memberships[orgs[0]]), nil
+}
+
+func (t tx) Member(org, id string) (domain.Person, error) {
+	p, ok := t.s.people[id][org]
 	if !ok {
-		return p, missing("person", id)
+		return p, missing("member of "+org, id)
 	}
 	return clonePerson(p), nil
 }
 
 func (t tx) People(org string) ([]domain.Person, error) {
 	var out []domain.Person
-	for _, p := range t.s.people {
-		if p.Organization == org {
+	for _, memberships := range t.s.people {
+		if p, ok := memberships[org]; ok {
 			out = append(out, clonePerson(p))
 		}
 	}
diff --git a/libraries/authority-core/go/storetest/memstore_test.go b/libraries/authority-core/go/storetest/memstore_test.go
new file mode 100644
index 00000000..995bb54a
--- /dev/null
+++ b/libraries/authority-core/go/storetest/memstore_test.go
@@ -0,0 +1,33 @@
+package storetest_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/memstore"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/storetest"
+)
+
+// The in-memory store meets the contract every host's store meets.
+func TestTheMemoryStoreMeetsTheStoreContract(t *testing.T) {
+	storetest.Run(t, func(t *testing.T, id storetest.Identity) authority.Store {
+		s := memstore.New()
+		for _, o := range id.Organizations {
+			s.PutOrganization(o)
+		}
+		for _, m := range id.Members {
+			p := domain.Person{ID: m.Person, Organization: m.Organization, Teams: m.Teams}
+			if m.Administrator {
+				p.Roles = append(p.Roles, "admin")
+			}
+			if len(m.Scopes) > 0 {
+				role := "storetest-" + m.Person
+				s.PutOrgRole(domain.OrgRole{Organization: m.Organization, Name: role, Scopes: m.Scopes})
+				p.Roles = append(p.Roles, role)
+			}
+			s.PutPerson(p)
+		}
+		return s
+	})
+}
diff --git a/libraries/authority-core/go/storetest/storetest.go b/libraries/authority-core/go/storetest/storetest.go
new file mode 100644
index 00000000..5aa434c7
--- /dev/null
+++ b/libraries/authority-core/go/storetest/storetest.go
@@ -0,0 +1,583 @@
+// Package storetest is the contract every authority.Store must meet, run
+// against the in-memory store here and against each host's own store there
+// (the accounts Postgres store, the local authority's): one transaction is all
+// or nothing, a missing record wraps domain.ErrNotFound, every record reads
+// back as written, grants are idempotent, every revision and epoch only grows,
+// and identity reads answer what the host seeded.
+//
+// Every id a run uses is fresh, so a host may run it against a store other
+// tests share.
+package storetest
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"sort"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	resources "github.com/codefly-dev/authority/libraries/resources/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/google/uuid"
+)
+
+// Identity is what a host seeds before its store is opened: organizations and
+// their members. Identity is the host's own data; the store only reads it.
+type Identity struct {
+	Organizations []domain.Organization
+	Members       []Member
+}
+
+// Member is one person's membership of one organization: an administrator
+// or not, their teams there, and the organization-role scopes they hold
+// there. A person may be a member of several organizations.
+type Member struct {
+	Organization, Person string
+	Administrator        bool
+	Teams                []string
+	Scopes               []domain.RoleScope
+}
+
+// Open seeds id into a store and opens it.
+type Open func(t *testing.T, id Identity) authority.Store
+
+// Run proves the contract against the stores open opens.
+func Run(t *testing.T, open Open) {
+	t.Helper()
+	ctx := context.Background()
+	f := newFixture()
+	store := open(t, f.identity)
+	read := func(t *testing.T, fn func(authority.Tx) error) {
+		t.Helper()
+		if err := store.Read(ctx, fn); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write := func(t *testing.T, fn func(authority.Tx) error) {
+		t.Helper()
+		if err := store.Write(ctx, fn); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	t.Run("identity reads answer what the host seeded", func(t *testing.T) {
+		read(t, func(tx authority.Tx) error {
+			all, err := tx.Organizations()
+			if err != nil {
+				return err
+			}
+			for _, want := range f.identity.Organizations {
+				got, err := tx.Organization(want.ID)
+				if err != nil || got.ID != want.ID || got.Name != want.Name {
+					t.Errorf("organization %s: %+v %v", want.ID, got, err)
+				}
+				if !slices.ContainsFunc(all, func(o domain.Organization) bool { return o.ID == want.ID }) {
+					t.Errorf("Organizations omits %s", want.ID)
+				}
+			}
+			for _, m := range f.identity.Members {
+				p, err := tx.Member(m.Organization, m.Person)
+				if err != nil {
+					t.Errorf("member %s of %s: %v", m.Person, m.Organization, err)
+					continue
+				}
+				if p.ID != m.Person || p.Organization != m.Organization || decide.IsAdministrator(p) != m.Administrator || !sameSet(p.Teams, m.Teams) {
+					t.Errorf("member %s of %s reads %+v, want %+v", m.Person, m.Organization, p, m)
+				}
+				if !m.Administrator {
+					held, err := heldScopes(tx, p)
+					if err != nil {
+						return err
+					}
+					if want := points(m.Scopes); !samePoints(held, want) {
+						t.Errorf("member %s of %s holds %v, want %v", m.Person, m.Organization, held, want)
+					}
+				}
+				if _, err := tx.Person(m.Person); err != nil {
+					t.Errorf("person %s: %v", m.Person, err)
+				}
+			}
+			for _, org := range f.identity.Organizations {
+				people, err := tx.People(org.ID)
+				if err != nil {
+					return err
+				}
+				var got, want []string
+				for _, p := range people {
+					got = append(got, p.ID)
+					if p.Organization != org.ID {
+						t.Errorf("People(%s) answered %s as a member of %s", org.ID, p.ID, p.Organization)
+					}
+				}
+				for _, m := range f.identity.Members {
+					if m.Organization == org.ID {
+						want = append(want, m.Person)
+					}
+				}
+				if !sameSet(got, want) {
+					t.Errorf("People(%s) = %v, want %v", org.ID, got, want)
+				}
+			}
+			if _, err := tx.Member(f.orgB, f.onlyA); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("a person is no member of an organization they do not belong to: %v", err)
+			}
+			if p, err := tx.Member(f.orgA, ""); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("an empty id names no member, not %+v: %v", p, err)
+			}
+			return nil
+		})
+	})
+
+	t.Run("a missing record wraps ErrNotFound", func(t *testing.T) {
+		absent := "storetest-absent-" + uuid.NewString()
+		read(t, func(tx authority.Tx) error {
+			for name, err := range map[string]error{
+				"organization":    second(tx.Organization(uuid.NewString())),
+				"person":          second(tx.Person(uuid.NewString())),
+				"member":          second(tx.Member(f.orgA, uuid.NewString())),
+				"module":          second(tx.Module(absent)),
+				"module by name":  second(tx.ModuleNamed(absent)),
+				"tombstone":       second(tx.Tombstone(absent)),
+				"tomb principal":  second(tx.TombstoneByPrincipal(absent)),
+				"installation":    second(tx.Installation(uuid.NewString())),
+				"by principal":    second(tx.InstallationByPrincipal(uuid.NewString())),
+				"empty principal": second(tx.InstallationByPrincipal("")),
+				"delegation":      second(tx.Delegation(uuid.NewString())),
+			} {
+				if !errors.Is(err, domain.ErrNotFound) {
+					t.Errorf("%s: %v", name, err)
+				}
+			}
+			return nil
+		})
+	})
+
+	t.Run("a module reads back as written, by name and by principal", func(t *testing.T) {
+		m := f.module("solution")
+		write(t, func(tx authority.Tx) error { return tx.PutModule(m) })
+		read(t, func(tx authority.Tx) error {
+			byName, err := tx.ModuleNamed(m.Name)
+			if err != nil {
+				return err
+			}
+			byPrincipal, err := tx.Module(m.Principal)
+			if err != nil {
+				return err
+			}
+			sameModule(t, byName, m)
+			sameModule(t, byPrincipal, m)
+			all, err := tx.Modules()
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(all, func(x domain.Module) bool { return x.Name == m.Name }) ||
+				!sort.SliceIsSorted(all, func(a, b int) bool { return all[a].Name < all[b].Name }) {
+				t.Errorf("Modules omits %s or is not sorted by name", m.Name)
+			}
+			return nil
+		})
+		m.Generation = 2
+		m.OwnerAware = false
+		write(t, func(tx authority.Tx) error { return tx.PutModule(m) })
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.ModuleNamed(m.Name)
+			sameModule(t, got, m)
+			return err
+		})
+		write(t, func(tx authority.Tx) error { return tx.DeleteModule(m.Name) })
+		read(t, func(tx authority.Tx) error {
+			if _, err := tx.ModuleNamed(m.Name); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("a deleted module still reads: %v", err)
+			}
+			return nil
+		})
+	})
+
+	t.Run("a tombstone reads back by name and by principal", func(t *testing.T) {
+		tomb := domain.Tombstone{Name: f.name("withdrawn"), Principal: f.name("withdrawn-principal"), Generation: 7}
+		write(t, func(tx authority.Tx) error { return tx.PutTombstone(tomb) })
+		read(t, func(tx authority.Tx) error {
+			a, err := tx.Tombstone(tomb.Name)
+			if err != nil {
+				return err
+			}
+			b, err := tx.TombstoneByPrincipal(tomb.Principal)
+			if err != nil {
+				return err
+			}
+			if a != tomb || b != tomb {
+				t.Errorf("tombstone %+v %+v, want %+v", a, b, tomb)
+			}
+			return nil
+		})
+	})
+
+	t.Run("an installation reads back as written", func(t *testing.T) {
+		inst := domain.Installation{ID: uuid.NewString(), Organization: f.orgA, Target: f.name("target"), Status: domain.Pending, Revision: 3,
+			AgentRole: "viewer", PrincipalID: uuid.NewString(), InstalledBy: f.onlyA,
+			Consent: domain.ConsentReceipt{OperationID: uuid.NewString(), Intent: "intent", Revision: 3},
+			Owned:   map[string][]string{"store.item": {"a", "b"}}}
+		module := domain.Installation{ID: uuid.NewString(), Organization: f.orgB, Target: f.name("module"), Status: domain.Active, Revision: 1}
+		write(t, func(tx authority.Tx) error {
+			if err := tx.PutInstallation(inst); err != nil {
+				return err
+			}
+			return tx.PutInstallation(module)
+		})
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.Installation(inst.ID)
+			if err != nil {
+				return err
+			}
+			sameInstallation(t, got, inst)
+			byPrincipal, err := tx.InstallationByPrincipal(inst.PrincipalID)
+			if err != nil {
+				return err
+			}
+			sameInstallation(t, byPrincipal, inst)
+			got, err = tx.Installation(module.ID)
+			if err != nil {
+				return err
+			}
+			sameInstallation(t, got, module)
+			ofA, err := tx.Installations(f.orgA)
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(ofA, func(i domain.Installation) bool { return i.ID == inst.ID }) || slices.ContainsFunc(ofA, func(i domain.Installation) bool { return i.ID == module.ID }) {
+				t.Errorf("Installations(%s) answers another organization's or omits its own: %v", f.orgA, ofA)
+			}
+			every, err := tx.Installations("")
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(every, func(i domain.Installation) bool { return i.ID == inst.ID }) || !slices.ContainsFunc(every, func(i domain.Installation) bool { return i.ID == module.ID }) ||
+				!sort.SliceIsSorted(every, func(a, b int) bool { return every[a].ID < every[b].ID }) {
+				t.Error("Installations(\"\") omits one or is not sorted by id")
+			}
+			return nil
+		})
+		inst.Status, inst.Revision, inst.Owned = domain.Revoked, 4, nil
+		write(t, func(tx authority.Tx) error { return tx.PutInstallation(inst) })
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.Installation(inst.ID)
+			sameInstallation(t, got, inst)
+			return err
+		})
+	})
+
+	t.Run("role grants are idempotent and kept per installation", func(t *testing.T) {
+		a, b := uuid.NewString(), uuid.NewString()
+		person := domain.RoleGrant{InstallationID: a, Role: "viewer", PersonID: f.onlyA}
+		team := domain.RoleGrant{InstallationID: a, Role: "viewer", TeamID: f.team}
+		other := domain.RoleGrant{InstallationID: b, Role: "editor", PersonID: f.onlyA}
+		write(t, func(tx authority.Tx) error {
+			for _, g := range []domain.RoleGrant{person, person, team, other} {
+				if err := tx.PutRoleGrant(g); err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+		grants := func(id string) []domain.RoleGrant {
+			var out []domain.RoleGrant
+			read(t, func(tx authority.Tx) (err error) { out, err = tx.RoleGrants(id); return err })
+			return out
+		}
+		if got := grants(a); len(got) != 2 || !slices.Contains(got, person) || !slices.Contains(got, team) {
+			t.Fatalf("grants of a: %v", got)
+		}
+		write(t, func(tx authority.Tx) error {
+			if err := tx.DeleteRoleGrant(person); err != nil {
+				return err
+			}
+			return tx.DeleteRoleGrant(person)
+		})
+		if got := grants(a); len(got) != 1 || got[0] != team {
+			t.Fatalf("after revoking the person: %v", got)
+		}
+		write(t, func(tx authority.Tx) error { return tx.DeleteRoleGrants(a) })
+		if got := grants(a); len(got) != 0 {
+			t.Fatalf("after clearing a: %v", got)
+		}
+		if got := grants(b); len(got) != 1 || got[0] != other {
+			t.Fatalf("clearing a touched b: %v", got)
+		}
+	})
+
+	t.Run("every revision and epoch only grows, each keyed as it is named", func(t *testing.T) {
+		inst := uuid.NewString()
+		audience := f.name("audience")
+		type counters struct{ org, otherOrg, person, otherPerson, grant, otherGrant, aware uint64 }
+		now := func() (c counters) {
+			read(t, func(tx authority.Tx) error {
+				var err error
+				for _, v := range []struct {
+					dst *uint64
+					get func() (uint64, error)
+				}{
+					{&c.org, func() (uint64, error) { return tx.AuthorizationRevision(f.orgA) }},
+					{&c.otherOrg, func() (uint64, error) { return tx.AuthorizationRevision(f.orgB) }},
+					{&c.person, func() (uint64, error) { return tx.PersonEpoch(f.onlyA) }},
+					{&c.otherPerson, func() (uint64, error) { return tx.PersonEpoch(f.both) }},
+					{&c.grant, func() (uint64, error) { return tx.GrantEpoch(f.onlyA, inst) }},
+					{&c.otherGrant, func() (uint64, error) { return tx.GrantEpoch(f.both, inst) }},
+					{&c.aware, func() (uint64, error) { return tx.OwnerAwareRevision(audience) }},
+				} {
+					if *v.dst, err = v.get(); err != nil {
+						return err
+					}
+				}
+				return nil
+			})
+			return c
+		}
+		before := now()
+		if before.org == 0 {
+			t.Error("an organization's authorization revision starts above zero")
+		}
+		write(t, func(tx authority.Tx) error {
+			for _, bump := range []func() error{
+				func() error { return tx.BumpAuthorizationRevision(f.orgA) },
+				func() error { return tx.BumpPersonEpoch(f.onlyA) },
+				func() error { return tx.BumpGrantEpoch(f.onlyA, inst) },
+				func() error { return tx.BumpOwnerAwareRevision(audience) },
+			} {
+				if err := bump(); err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+		after := now()
+		if after.org <= before.org || after.person <= before.person || after.grant <= before.grant || after.aware <= before.aware {
+			t.Errorf("a bump did not grow its counter: before %+v after %+v", before, after)
+		}
+		if after.otherOrg != before.otherOrg || after.otherPerson != before.otherPerson || after.otherGrant != before.otherGrant {
+			t.Errorf("a bump moved another key's counter: before %+v after %+v", before, after)
+		}
+		read(t, func(tx authority.Tx) error {
+			if _, err := tx.AuthorizationRevision(uuid.NewString()); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("an absent organization has no revision: %v", err)
+			}
+			return nil
+		})
+	})
+
+	t.Run("a delegation reads back as written", func(t *testing.T) {
+		d := domain.Delegation{ID: uuid.NewString(), Organization: f.orgA, Grantor: f.onlyA, Module: f.name("module"), Purpose: "a purpose",
+			Scopes: []*basev0.WorkScopeV1{{ResourceKind: "k", Actions: []string{"read"}, ResourceIds: []string{"a"}}}}
+		write(t, func(tx authority.Tx) error { return tx.PutDelegation(d) })
+		d.Revoked = true
+		write(t, func(tx authority.Tx) error { return tx.PutDelegation(d) })
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.Delegation(d.ID)
+			if err != nil {
+				return err
+			}
+			if got.ID != d.ID || got.Organization != d.Organization || got.Grantor != d.Grantor || got.Module != d.Module || got.Purpose != d.Purpose ||
+				!got.Revoked || !scope.Same(got.Scopes, d.Scopes) {
+				t.Errorf("delegation %+v, want %+v", got, d)
+			}
+			all, err := tx.Delegations()
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(all, func(x domain.Delegation) bool { return x.ID == d.ID }) ||
+				!sort.SliceIsSorted(all, func(a, b int) bool { return all[a].ID < all[b].ID }) {
+				t.Error("Delegations omits it or is not sorted by id")
+			}
+			return nil
+		})
+	})
+
+	t.Run("a failed transaction leaves nothing behind", func(t *testing.T) {
+		// A solution: the core writes its installations whatever the host, where
+		// a module's may be the host's own records (Config.HostInstallsModules).
+		m := f.module(domain.KindSolution)
+		m.Name, m.Principal = f.name("failed"), f.name("failed-principal")
+		inst := domain.Installation{ID: uuid.NewString(), Organization: f.orgA, Target: m.Name, Status: domain.Active, Revision: 1}
+		var before uint64
+		read(t, func(tx authority.Tx) (err error) { before, err = tx.AuthorizationRevision(f.orgA); return err })
+		failure := errors.New("the decision refused")
+		err := store.Write(ctx, func(tx authority.Tx) error {
+			if err := tx.PutModule(m); err != nil {
+				return err
+			}
+			if err := tx.PutInstallation(inst); err != nil {
+				return err
+			}
+			if err := tx.PutRoleGrant(domain.RoleGrant{InstallationID: inst.ID, Role: "viewer", PersonID: f.onlyA}); err != nil {
+				return err
+			}
+			if err := tx.BumpAuthorizationRevision(f.orgA); err != nil {
+				return err
+			}
+			// What a transaction wrote, it reads.
+			if _, err := tx.ModuleNamed(m.Name); err != nil {
+				return err
+			}
+			return failure
+		})
+		if !errors.Is(err, failure) {
+			t.Fatalf("the transaction's own error is returned: %v", err)
+		}
+		read(t, func(tx authority.Tx) error {
+			if _, err := tx.ModuleNamed(m.Name); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("the module survived: %v", err)
+			}
+			if _, err := tx.Installation(inst.ID); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("the installation survived: %v", err)
+			}
+			if grants, err := tx.RoleGrants(inst.ID); err != nil || len(grants) != 0 {
+				t.Errorf("the grant survived: %v %v", grants, err)
+			}
+			if after, err := tx.AuthorizationRevision(f.orgA); err != nil || after != before {
+				t.Errorf("the revision moved: %d → %d %v", before, after, err)
+			}
+			return nil
+		})
+	})
+}
+
+type fixture struct {
+	identity                Identity
+	run                     string
+	orgA, orgB, onlyA, both string
+	team                    string
+}
+
+func newFixture() *fixture {
+	f := &fixture{run: uuid.NewString()[:8], orgA: uuid.NewString(), orgB: uuid.NewString(), onlyA: uuid.NewString(), both: uuid.NewString(), team: uuid.NewString()}
+	reader := []domain.RoleScope{{Kind: "storetest.item", Actions: []string{"read"}}, {Kind: "storetest.note", Actions: []string{"write"}, Resources: []resources.Grant{{ID: "note-1"}}}}
+	f.identity = Identity{
+		Organizations: []domain.Organization{{ID: f.orgA, Name: "Storetest A " + f.run}, {ID: f.orgB, Name: "Storetest B " + f.run}},
+		Members: []Member{
+			{Organization: f.orgA, Person: f.onlyA, Teams: []string{f.team}, Scopes: reader},
+			{Organization: f.orgA, Person: f.both, Administrator: true},
+			{Organization: f.orgB, Person: f.both, Scopes: []domain.RoleScope{{Kind: "storetest.item", Actions: []string{"write"}}}},
+		},
+	}
+	return f
+}
+
+func (f *fixture) name(what string) string { return "storetest-" + what + "-" + f.run }
+
+func (f *fixture) module(kind string) domain.Module {
+	read := []*basev0.WorkScopeV1{{ResourceKind: "storetest.item", Actions: []string{"read"}}}
+	m := domain.Module{Name: f.name(kind), Principal: f.name(kind + "-principal"), Kind: kind, Generation: 1, OwnerAware: true,
+		ResourceKinds: []*basev0.WorkScopeV1{{ResourceKind: "storetest.item", Actions: []string{"read", "write"}}},
+		Bindings:      map[string]domain.Binding{"store": {ID: "store", Audience: "store", InvokeScopes: read, HeadlessScopes: read, LookupScopes: read}},
+		Methods:       map[string]domain.MethodPolicy{"/s.S/Read": {Requires: read}, "GET /open": {AnyCheckedCaller: true}}}
+	if kind == domain.KindSolution {
+		m.Roles = map[string][]*basev0.WorkScopeV1{domain.InstallerRole: read, "viewer": read}
+		m.OwnedRoles = map[string][]*basev0.WorkScopeV1{"viewer": {{ResourceKind: "store.item", Actions: []string{"read"}}}}
+	}
+	return m
+}
+
+func second[T any](_ T, err error) error { return err }
+
+func sameSet(a, b []string) bool {
+	return slices.Equal(slices.Sorted(slices.Values(slices.Clone(a))), slices.Sorted(slices.Values(slices.Clone(b))))
+}
+
+func sameScopes(a, b []*basev0.WorkScopeV1) bool {
+	return scope.Same(scope.Normalize(a), scope.Normalize(b))
+}
+
+func sameModule(t *testing.T, got, want domain.Module) {
+	t.Helper()
+	ok := got.Name == want.Name && got.Principal == want.Principal && got.Kind == want.Kind && got.Generation == want.Generation &&
+		got.StandIn == want.StandIn && got.OwnerAware == want.OwnerAware && sameScopes(got.ResourceKinds, want.ResourceKinds) &&
+		len(got.Bindings) == len(want.Bindings) && len(got.Roles) == len(want.Roles) && len(got.OwnedRoles) == len(want.OwnedRoles) && len(got.Methods) == len(want.Methods)
+	for id, b := range want.Bindings {
+		g := got.Bindings[id]
+		ok = ok && g.ID == b.ID && g.Audience == b.Audience && sameScopes(g.InvokeScopes, b.InvokeScopes) && sameScopes(g.HeadlessScopes, b.HeadlessScopes) && sameScopes(g.LookupScopes, b.LookupScopes)
+	}
+	for name, scopes := range want.Roles {
+		ok = ok && sameScopes(got.Roles[name], scopes)
+	}
+	for name, scopes := range want.OwnedRoles {
+		ok = ok && sameScopes(got.OwnedRoles[name], scopes)
+	}
+	for method, p := range want.Methods {
+		g := got.Methods[method]
+		ok = ok && g.AnyCheckedCaller == p.AnyCheckedCaller && sameScopes(g.Requires, p.Requires)
+	}
+	if !ok {
+		t.Errorf("module reads %+v, want %+v", got, want)
+	}
+}
+
+func sameInstallation(t *testing.T, got, want domain.Installation) {
+	t.Helper()
+	ok := got.ID == want.ID && got.Organization == want.Organization && got.Target == want.Target && got.Status == want.Status &&
+		got.Revision == want.Revision && got.AgentRole == want.AgentRole && got.PrincipalID == want.PrincipalID &&
+		got.InstalledBy == want.InstalledBy && got.Consent == want.Consent && len(got.Owned) == len(nonEmpty(want.Owned))
+	for k, ids := range nonEmpty(want.Owned) {
+		ok = ok && slices.Equal(got.Owned[k], ids)
+	}
+	if !ok {
+		t.Errorf("installation reads %+v, want %+v", got, want)
+	}
+}
+
+func nonEmpty(m map[string][]string) map[string][]string {
+	out := map[string][]string{}
+	for k, v := range m {
+		if len(v) > 0 {
+			out[k] = v
+		}
+	}
+	return out
+}
+
+// point is one (kind, action, resource matcher) an organization role grants.
+type point struct{ kind, action, resource string }
+
+func points(scopes []domain.RoleScope) map[point]bool {
+	out := map[point]bool{}
+	for _, sc := range scopes {
+		for _, a := range sc.Actions {
+			if len(sc.Resources) == 0 {
+				out[point{sc.Kind, a, ""}] = true
+			}
+			for _, r := range sc.Resources {
+				out[point{sc.Kind, a, r.ID + "|" + r.Prefix + "|" + r.Pattern}] = true
+			}
+		}
+	}
+	return out
+}
+
+func heldScopes(tx authority.Tx, p domain.Person) (map[point]bool, error) {
+	var all []domain.RoleScope
+	for _, name := range p.Roles {
+		r, err := tx.OrgRole(p.Organization, name)
+		if errors.Is(err, domain.ErrNotFound) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		all = append(all, r.Scopes...)
+	}
+	return points(all), nil
+}
+
+func samePoints(a, b map[point]bool) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k := range a {
+		if !b[k] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/libraries/conformance/go/conformance.go b/libraries/conformance/go/conformance.go
index bd6bfd90..15219bb0 100644
--- a/libraries/conformance/go/conformance.go
+++ b/libraries/conformance/go/conformance.go
@@ -60,6 +60,11 @@ type Fixture struct {
 	Lifecycle *InstallationLifecycleCase
 	// OwnerToken is a member with the organization owner role, not admin.
 	OwnerToken string
+	// OtherAdminToken signs in an administrator of another organization.
+	OtherAdminToken string
+	// HopCredential is the workload credential of the composition's hop, the
+	// one workload that registers admission keys.
+	HopCredential string
 
 	// SolutionTools exercises a module binding to a solution with distinct person entitlements.
 	SolutionTools *SolutionToolsCase
@@ -71,6 +76,12 @@ type Fixture struct {
 	HostDomain         string
 	SignManifest       func(document []byte) (envelope []byte, err error)
 	DeliveryCredential func(module string) string
+	// InstallModule, for a host whose administrators install each module by
+	// their own consent, installs one the suite just delivered at the
+	// organizations the suite uses, through the host's own path; it must be
+	// idempotent, since a module is delivered again at newer generations. nil:
+	// delivery installs a module at every organization.
+	InstallModule func(ctx context.Context, module string) error
 	// Resources is required and states what a person covers on one kind.
 	Resources *ResourceCase
 	// Lookup is a binding whose lookup scopes are narrower than its invoke
@@ -128,8 +139,9 @@ type Hop struct {
 }
 
 // ResourceCase is one ListResources expectation: a person signed in with Token
-// and issued at Audience covers each id of Covered and none of Uncovered for
-// Action on Kind, and does not hold Unheld on Kind at all.
+// and issued at Audience on Covered covers each id of Covered and none of
+// Uncovered for Action on Kind, and does not hold Unheld on Kind at all. An
+// ask naming an id of Uncovered, or the whole kind, is refused.
 type ResourceCase struct {
 	Token     string
 	Audience  string
@@ -225,7 +237,7 @@ func (c *client) deliver(ctx context.Context, f Fixture, alias, kind string, gen
 	request := map[string]any{
 		"carrier": map[string]any{"document": carrier, "envelope": envelope}, "credential": f.DeliveryCredential(alias)}
 	if document == nil {
-		return c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request)
+		return installed(ctx, f, alias, kind)(c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request))
 	}
 	d, err := c.files.FindDescriptorByName("host.composition.v1.AuthorityManifestV1")
 	if err != nil {
@@ -249,7 +261,21 @@ func (c *client) deliver(ctx context.Context, f Fixture, alias, kind string, gen
 		return nil, err
 	}
 	request["authority"] = map[string]any{"document": authority, "envelope": signed}
-	return c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request)
+	return installed(ctx, f, alias, kind)(c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request))
+}
+
+// installed has the host install a module it just composed, when its
+// administrators install modules by consent (Fixture.InstallModule).
+func installed(ctx context.Context, f Fixture, alias, kind string) func(protoreflect.Message, error) (protoreflect.Message, error) {
+	return func(out protoreflect.Message, err error) (protoreflect.Message, error) {
+		if err != nil || kind != "module" || f.InstallModule == nil {
+			return out, err
+		}
+		if err := f.InstallModule(ctx, alias); err != nil {
+			return nil, fmt.Errorf("the host installing %s: %w", alias, err)
+		}
+		return out, nil
+	}
 }
 
 // Run drives the suite over one connection, from the published descriptors.
@@ -702,12 +728,12 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 			t.Fatal("required conformance fixture missing: the fixture states no resource case")
 		}
 		sess := c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": rc.Token})
-		issue := func(scopes []any) string {
+		issue := func(scopes []any) (protoreflect.Message, error) {
 			fields := map[string]any{"person": map[string]any{}, "audience": rc.Audience}
 			if scopes != nil {
 				fields["scopes"] = scopes
 			}
-			return str(c.must(t, as(ctx, sess), "host.authority.v1.AuthorityService", "Issue", fields), "token")
+			return c.call(as(ctx, sess), "host.authority.v1.AuthorityService", "Issue", fields)
 		}
 		list := func(token, action string) (*resources.Matcher, error) {
 			out, err := c.call(ctx, "host.authority.v1.AuthorityService", "ListResources", map[string]any{
@@ -717,7 +743,13 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 			}
 			return resources.Compile(grantsOf(out))
 		}
-		covered, err := list(issue(nil), rc.Action)
+		// A context asking for the covered ids carries them: the authority
+		// answers each covered and none of the uncovered.
+		out, err := issue([]any{scopeAsk(rc.Kind, []string{rc.Action}, rc.Covered)})
+		if err != nil {
+			t.Fatalf("issue on the covered ids: %v", err)
+		}
+		covered, err := list(str(out, "token"), rc.Action)
 		if err != nil {
 			t.Fatalf("list %s:%s: %v", rc.Kind, rc.Action, err)
 		}
@@ -731,20 +763,41 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 				t.Errorf("%s is covered", id)
 			}
 		}
-		if _, err := list(issue(nil), rc.Unheld); status.Code(err) != codes.PermissionDenied {
+		if covered.All() {
+			t.Error("a context on named ids covers the whole kind")
+		}
+		if _, err := list(str(out, "token"), rc.Unheld); status.Code(err) != codes.PermissionDenied {
 			t.Fatalf("an action the context does not hold: %v", err)
 		}
-		if len(rc.Covered) > 0 && len(rc.Uncovered) > 0 {
-			// A context narrowed to two ids covers the one the person holds.
-			narrowed, err := list(issue([]any{map[string]any{"resource_kind": rc.Kind, "actions": []any{rc.Action},
-				"resource_ids": []any{rc.Covered[0], rc.Uncovered[0]}}}), rc.Action)
-			if err != nil {
-				t.Fatalf("narrowed: %v", err)
-			}
-			if !narrowed.Matches(rc.Covered[0]) || narrowed.Matches(rc.Uncovered[0]) || narrowed.All() {
-				t.Fatalf("a narrowed context covers exactly the held id it names")
+		// An empty ask never carries the kind whole: a module deciding from
+		// the context's claims would read it as every resource. Each row of
+		// the kind it carries names ids, none of them uncovered.
+		if out, err := issue(nil); err == nil {
+			for _, row := range listMsgs(msg(out, "context"), "authority_scopes") {
+				if str(row, "resource_kind") != rc.Kind || field(row, "actions").List().Len() == 0 {
+					continue
+				}
+				ids := field(row, "resource_ids").List()
+				if ids.Len() == 0 {
+					t.Fatalf("an empty ask carries the whole of %s", rc.Kind)
+				}
+				for i := 0; i < ids.Len(); i++ {
+					if slices.Contains(rc.Uncovered, ids.Get(i).String()) {
+						t.Fatalf("an empty ask carries %s, which the person does not hold", ids.Get(i).String())
+					}
+				}
 			}
+		} else if status.Code(err) != codes.PermissionDenied {
+			t.Fatalf("an empty ask: %v", err)
+		}
+		// An ask naming an uncovered id is refused, even beside a covered one,
+		// and so is an ask for the whole kind.
+		if len(rc.Covered) > 0 && len(rc.Uncovered) > 0 {
+			_, err := issue([]any{scopeAsk(rc.Kind, []string{rc.Action}, []string{rc.Covered[0], rc.Uncovered[0]})})
+			refused(t, err, codes.PermissionDenied, "widens")
 		}
+		_, err = issue([]any{scopeAsk(rc.Kind, []string{rc.Action}, nil)})
+		refused(t, err, codes.PermissionDenied, "what the owner holds")
 	})
 	t.Run("a lookup through a binding carries only the binding's lookup scopes", func(t *testing.T) {
 		lc := f.Lookup
@@ -834,6 +887,8 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 	})
 	c.resourceMethod(t, ctx, f)
 	c.installationLifecycle(t, ctx, f)
+	c.organizationIsolation(t, ctx, f)
+	c.admissionKeys(t, ctx, f)
 }
 
 // scopeActions is a context's actions on kind, comma-joined.
diff --git a/libraries/conformance/go/go.mod b/libraries/conformance/go/go.mod
index 2b37d00c..79ba82ae 100644
--- a/libraries/conformance/go/go.mod
+++ b/libraries/conformance/go/go.mod
@@ -3,7 +3,7 @@ module github.com/codefly-dev/authority/libraries/conformance/go
 go 1.27.3
 
 require (
-	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026180113-c5b5e23960ab
+	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026232801-7b6569e1f285
 	github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7
 	github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2
 	github.com/google/uuid v1.6.0
diff --git a/libraries/conformance/go/go.sum b/libraries/conformance/go/go.sum
index a665ca1f..6e2c3808 100644
--- a/libraries/conformance/go/go.sum
+++ b/libraries/conformance/go/go.sum
@@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
 github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026180113-c5b5e23960ab h1:2c2+mvN0H0AvfH0gSLR8Iyi/WqP31TX8uE3IV64mpDk=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026180113-c5b5e23960ab/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026232801-7b6569e1f285 h1:evq/BoytmbddnA/r7thGb25PMrveFZp0HP0OiVXyO9I=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026232801-7b6569e1f285/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7 h1:7vdTj6aLQVyFf0MWWgUnR/otX1v9xN6AbFKC2cHrQjE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2 h1:I1wL0ANXhTdQuEAnxXF+s4+rKILlBu/QHILq4Skyi3I=
diff --git a/libraries/conformance/go/isolation.go b/libraries/conformance/go/isolation.go
new file mode 100644
index 00000000..cfc8508c
--- /dev/null
+++ b/libraries/conformance/go/isolation.go
@@ -0,0 +1,179 @@
+package conformance
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/codefly-dev/authority/libraries/authority-client/go/stamp"
+	"google.golang.org/grpc/codes"
+)
+
+// organizationIsolation: an administrator acts on no organization but their
+// session's, and an installation the request's organization does not hold
+// answers alike whether another organization holds it or nobody does, so no
+// caller learns which installations exist. A module nobody composed is
+// NotFound by name wherever it is named.
+func (c *client) organizationIsolation(t *testing.T, ctx context.Context, f Fixture) {
+	t.Run("every installation call stays inside the caller's organization, and an absent installation answers as a foreign one", func(t *testing.T) {
+		if f.InstalledSolution == "" {
+			t.Fatal("required conformance fixture missing: an active installation")
+		}
+		admin := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.AdminToken}))
+		const foreign, absent = "conformance-another-org", "conformance-absent-installation"
+		person := str(c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.ViewerToken}), "person_id")
+		for _, tc := range []struct {
+			name, method string
+			fields       map[string]any
+			reason       string
+		}{
+			{"review at another organization", "Review", map[string]any{"organization_id": foreign, "target": f.InstalledAudience}, "organization"},
+			{"install at another organization", "Install", map[string]any{"organization_id": foreign, "target": f.InstalledAudience, "role": "viewer"}, "organization"},
+			{"list another organization", "List", map[string]any{"organization_id": foreign}, "organization"},
+			{"grants at another organization", "ListRoleGrants", map[string]any{"organization_id": foreign, "installation_id": f.InstalledSolution}, "organization"},
+			{"grant at another organization", "GrantRole", map[string]any{"organization_id": foreign, "installation_id": f.InstalledSolution, "role": "viewer", "person_id": person}, "organization"},
+			{"revoke at another organization", "RevokeRole", map[string]any{"organization_id": foreign, "installation_id": f.InstalledSolution, "role": "viewer", "person_id": person}, "organization"},
+			{"grants of an absent installation", "ListRoleGrants", map[string]any{"organization_id": f.Organization, "installation_id": absent}, "another organization"},
+			{"grant on an absent installation", "GrantRole", map[string]any{"organization_id": f.Organization, "installation_id": absent, "role": "viewer", "person_id": person}, "another organization"},
+			{"revoke on an absent installation", "RevokeRole", map[string]any{"organization_id": f.Organization, "installation_id": absent, "role": "viewer", "person_id": person}, "another organization"},
+		} {
+			t.Run(tc.name, func(t *testing.T) {
+				_, err := c.call(admin, "host.installation.v1.InstallationService", tc.method, tc.fields)
+				refused(t, err, codes.PermissionDenied, tc.reason)
+			})
+		}
+		t.Run("a module nobody composed is named as such", func(t *testing.T) {
+			viewer := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.ViewerToken}))
+			_, err := c.call(viewer, "host.authority.v1.AuthorityService", "Delegate", map[string]any{"module": "conformance-not-composed", "purpose": "a job",
+				"scopes": []any{map[string]any{"resource_kind": f.ReadKind, "actions": []any{"read"}}}})
+			refused(t, err, codes.NotFound, "conformance-not-composed")
+			_, err = c.call(admin, "host.installation.v1.InstallationService", "Review", map[string]any{"organization_id": f.Organization, "target": "conformance-not-composed"})
+			refused(t, err, codes.NotFound, "conformance-not-composed")
+		})
+		t.Run("another organization's delegation is never read or ended", func(t *testing.T) {
+			if f.Delegation == nil || f.OtherAdminToken == "" {
+				t.Fatal("required conformance fixture missing: a delegation and another organization's administrator")
+			}
+			grantor := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.Delegation.Token}))
+			d := c.must(t, grantor, "host.authority.v1.AuthorityService", "Delegate", map[string]any{"module": f.Delegation.Module, "purpose": "isolation",
+				"scopes": []any{map[string]any{"resource_kind": f.Delegation.Kind, "actions": []any{f.Delegation.Action}}}})
+			other := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.OtherAdminToken}))
+			for _, method := range []string{"GetDelegation", "RevokeDelegation"} {
+				_, err := c.call(other, "host.authority.v1.AuthorityService", method, map[string]any{"delegation_id": str(d, "delegation_id")})
+				refused(t, err, codes.NotFound, "delegation")
+			}
+			c.must(t, grantor, "host.authority.v1.AuthorityService", "RevokeDelegation", map[string]any{"delegation_id": str(d, "delegation_id")})
+		})
+	})
+}
+
+// admissionKeys: only the hop registers the key it signs call admissions with;
+// Keys publishes it among the admission keys with the hop-admission purpose,
+// never among the Work Context keys; registering it again renews the one
+// entry; any other workload, and a key that is not an Ed25519 public key, is
+// refused by name.
+func (c *client) admissionKeys(t *testing.T, ctx context.Context, f Fixture) {
+	t.Run("only the hop registers an admission key, published apart from the Work Context keys", func(t *testing.T) {
+		if f.HopCredential == "" {
+			t.Fatal("required conformance fixture missing: the hop's workload credential")
+		}
+		seed := sha256.Sum256([]byte("conformance hop admission"))
+		public := ed25519.NewKeyFromSeed(seed[:]).Public().(ed25519.PublicKey)
+		signer, err := stamp.NewSigner(hex.EncodeToString(seed[:]))
+		if err != nil {
+			t.Fatal(err)
+		}
+		// Each registration carries a fresh proof, signed by the key it
+		// registers, over the credential presented and the authority the
+		// credential is addressed to (stamp.ProveRegistration).
+		register := func(credential string, key []byte) (string, error) {
+			audience, err := credentialAudience(credential)
+			if err != nil {
+				t.Fatal(err)
+			}
+			proof, err := signer.ProveRegistration(credential, audience, time.Now())
+			if err != nil {
+				t.Fatal(err)
+			}
+			out, err := c.call(ctx, "host.authority.v1.AuthorityService", "RegisterAdmissionKey", map[string]any{
+				"actor": map[string]any{"credential": credential}, "public_key": key, "proof": proof})
+			if err != nil {
+				return "", err
+			}
+			key0 := msg(out, "key")
+			if str(key0, "purpose") != stamp.Purpose {
+				t.Fatalf("a registered key's purpose is %q, want %q", str(key0, "purpose"), stamp.Purpose)
+			}
+			return str(key0, "key_id"), nil
+		}
+		id, err := register(f.HopCredential, public)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if id != stamp.KeyID(public) {
+			t.Fatalf("the registered key id is %q, want stamp.KeyID %q", id, stamp.KeyID(public))
+		}
+		again, err := register(f.HopCredential, public)
+		if err != nil || again != id {
+			t.Fatalf("registering the key again renews it: %q %v", again, err)
+		}
+		keys := c.must(t, ctx, "host.authority.v1.AuthorityService", "Keys", map[string]any{})
+		published := 0
+		for _, k := range listMsgs(keys, "admission_keys") {
+			if str(k, "key_id") == id {
+				published++
+				if str(k, "purpose") != stamp.Purpose || string(field(k, "public_key").Bytes()) != string(public) {
+					t.Fatalf("published admission key %v", k)
+				}
+			}
+		}
+		if published != 1 {
+			t.Fatalf("the hop's key is published %d times among the admission keys, want once", published)
+		}
+		for _, k := range listMsgs(keys, "keys") {
+			if str(k, "key_id") == id || str(k, "purpose") != "work-context" {
+				t.Fatalf("an admission key is never a Work Context key: %v", k)
+			}
+		}
+		_, err = register(f.WorkloadCredential, public)
+		refused(t, err, codes.PermissionDenied, "hop")
+		_, err = register(f.HopCredential, public[:16])
+		refused(t, err, codes.InvalidArgument, "32")
+	})
+}
+
+// credentialAudience is the one audience a workload credential (a compact JWS)
+// is issued for: the authority a registration proof names. It verifies
+// nothing; the authority attests the credential.
+func credentialAudience(credential string) (string, error) {
+	parts := strings.Split(credential, ".")
+	if len(parts) != 3 {
+		return "", errors.New("the hop's credential is not a compact JWS, so it names no audience to prove a registration to")
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", err
+	}
+	var claims struct {
+		Audience json.RawMessage `json:"aud"`
+	}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return "", err
+	}
+	var one string
+	var many []string
+	switch {
+	case json.Unmarshal(claims.Audience, &one) == nil && one != "":
+		return one, nil
+	case json.Unmarshal(claims.Audience, &many) == nil && len(many) == 1 && many[0] != "":
+		return many[0], nil
+	}
+	return "", errors.New("the hop's credential names no single audience")
+}
diff --git a/libraries/conformance/go/solution_principal.go b/libraries/conformance/go/solution_principal.go
index 78d7de27..1bfe41d3 100644
--- a/libraries/conformance/go/solution_principal.go
+++ b/libraries/conformance/go/solution_principal.go
@@ -90,7 +90,9 @@ type SolutionPrincipalCase struct {
 	RemoveFromOrganization                         func(ctx context.Context, personID string) error
 	SignManifest, SignAuthority                    func(document []byte) ([]byte, error)
 	DeliveryCredential                             func(module string) string
-	HostCoordinate, HostDomain                     string
+	// InstallModule is Fixture.InstallModule, for the modules this suite delivers.
+	InstallModule              func(ctx context.Context, module string) error
+	HostCoordinate, HostDomain string
 }
 
 // SolutionUnderTest is one solution the suite delivers and installs.
@@ -634,7 +636,8 @@ func (sp *principalSuite) deliverStore(t *testing.T, ownerAware bool) {
 }
 
 func (sp *principalSuite) delivery() Fixture {
-	return Fixture{SignManifest: sp.f.SignManifest, SignAuthority: sp.f.SignAuthority, DeliveryCredential: sp.f.DeliveryCredential, HostCoordinate: sp.f.HostCoordinate, HostDomain: sp.f.HostDomain}
+	return Fixture{SignManifest: sp.f.SignManifest, SignAuthority: sp.f.SignAuthority, DeliveryCredential: sp.f.DeliveryCredential, HostCoordinate: sp.f.HostCoordinate, HostDomain: sp.f.HostDomain,
+		InstallModule: sp.f.InstallModule}
 }
 
 func countOf(list []string, want string) int {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go b/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go
index a9b32d29..586359af 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"gateway/pkg/business/issuer"
+	"gateway/pkg/business/state"
 	"gateway/pkg/business/testkit"
 	authorityv1 "gateway/pkg/gen/host/authority/v1"
 )
@@ -81,7 +82,8 @@ func TestADelegationIssuesAsItsGrantorUntilRevoked(t *testing.T) {
 	if _, err := issue("documents"); !errors.Is(err, issuer.ErrRefused) {
 		t.Fatalf("another module presents the delegation: %v", err)
 	}
-	if _, err := k.Issuer.RevokeDelegation(person(t, k, "fixture-maya"), d.ID); !errors.Is(err, issuer.ErrRefused) {
+	// Someone else, neither its grantor nor an administrator, learns nothing of it.
+	if _, err := k.Issuer.RevokeDelegation(person(t, k, "fixture-maya"), d.ID); !errors.Is(err, state.ErrUnknown) {
 		t.Fatalf("someone else revokes it: %v", err)
 	}
 	if _, err := k.Issuer.RevokeDelegation(remi, d.ID); err != nil {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/issuer.go b/modules/authority/services/local/code/pkg/business/issuer/issuer.go
index 8a359076..bf52b4ed 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/issuer.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/issuer.go
@@ -144,18 +144,15 @@ func (i *Issuer) checked(ctx context.Context, token, audience, method string, ad
 	if audience == "" {
 		return nil, fmt.Errorf("%w: a check names the audience the caller is", ErrRefused)
 	}
-	verified, revision, err := i.svc.Check(ctx, token, audience)
+	verified, revision, denied, err := i.svc.CheckMethod(ctx, token, audience, method, advisory)
 	if err != nil {
 		return nil, err
 	}
 	refusal := ""
-	if method != "" {
-		if err := i.state.AdmitMethod(audience, method, verified.EffectiveScopes()); err != nil {
-			if !advisory {
-				return nil, err
-			}
-			refusal = err.Error()
-		}
+	if denied != nil {
+		// The advisory answer names the refusal exactly as an enforced check
+		// reports it.
+		refusal = classify(denied).Error()
 	}
 	wc, err := ToWire(verified.Context())
 	if err != nil {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go b/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go
index 89620672..4de469b0 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go
@@ -140,8 +140,9 @@ func TestAPersonIsIssuedWhatHerRolesHoldAtTheAudienceAndNoMore(t *testing.T) {
 	if wc.GetOwnerPrincipalId() != "maya" || wc.GetTenantId() != "acme" || wc.GetAudience() != "documents" {
 		t.Fatalf("context = %v", wc)
 	}
-	// The viewer reads documents, and reads collections at the kind: which
-	// collections is the authority's answer to ListResources, not the token's.
+	// The viewer reads documents. She reads collections only by prefix and
+	// pattern, which a token cannot carry and never carries as the whole
+	// kind: an ask naming no collection carries none.
 	got := map[string]string{}
 	for _, sc := range wc.GetAuthorityScopes() {
 		got[sc.GetResourceKind()] = strings.Join(sc.GetActions(), ",")
@@ -149,7 +150,7 @@ func TestAPersonIsIssuedWhatHerRolesHoldAtTheAudienceAndNoMore(t *testing.T) {
 			t.Fatalf("the token names no resource: %v", sc)
 		}
 	}
-	if len(got) != 2 || got["documents"] != "read" || got["documents.collection"] != "read" {
+	if len(got) != 1 || got["documents"] != "read" {
 		t.Fatalf("viewer scopes = %v", wc.GetAuthorityScopes())
 	}
 	if wc.GetSeal().GetInstallationId() != state.InstallationID("acme", "documents") {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go b/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go
index 12ad39e8..08b4114b 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go
@@ -167,7 +167,7 @@ func TestDisjointTargetScopeStaysDeniedAfterLaterHops(t *testing.T) {
 				if _, err := k.Issuer.Check(t.Context(), parent.Token, "model", "/model.Service/ReadDocument"); err != nil {
 					t.Fatal(err)
 				}
-				if _, err := k.Issuer.Check(t.Context(), parent.Token, "model", "/model.Service/ReadProfile"); !errors.Is(err, state.ErrForbidden) {
+				if _, err := k.Issuer.Check(t.Context(), parent.Token, "model", "/model.Service/ReadProfile"); !errors.Is(err, issuer.ErrRefused) {
 					t.Fatalf("denied kind admitted by policy: %v", err)
 				}
 				if _, err := k.Issuer.ListResources(t.Context(), parent.Token, "model", "modelservice.profiles", "read"); !errors.Is(err, issuer.ErrRefused) {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/resources_test.go b/modules/authority/services/local/code/pkg/business/issuer/resources_test.go
index b98fb72b..6aed7531 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/resources_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/resources_test.go
@@ -3,9 +3,11 @@ package issuer_test
 import (
 	"context"
 	"errors"
-	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"strings"
 	"testing"
 
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+
 	resources "github.com/codefly-dev/authority/libraries/resources/go"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 
@@ -41,12 +43,16 @@ func covered(t *testing.T, owned []authority.Grant) *resources.Matcher {
 	return m
 }
 
-// The authority answers which collections a person reads from her roles, now;
-// the token carries the kind alone.
+// The authority answers which collections a person reads from her roles, now.
+// Maya reads by prefix and pattern, which a token cannot carry: she names the
+// collections she acts on, and an ask naming none carries none of the kind.
 func TestTheAuthorityAnswersWhichResourcesAContextCovers(t *testing.T) {
 	k := testkit.New(t)
 	ctx := context.Background()
-	maya, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.collection", "read")
+	named := issued(t, k, "fixture-maya", []*authorityv1.WorkScopeV1{
+		{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory", "shared-finance"}},
+	})
+	maya, err := k.Issuer.ListResources(ctx, named, "documents", "documents.collection", "read")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -56,24 +62,38 @@ func TestTheAuthorityAnswersWhichResourcesAContextCovers(t *testing.T) {
 			t.Errorf("maya %q: want %v", id, want)
 		}
 	}
+	if m.All() {
+		t.Error("maya reads every collection")
+	}
+	if _, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.collection", "read"); !errors.Is(err, issuer.ErrRefused) {
+		t.Fatalf("an ask naming no collection carried the kind: %v", err)
+	}
 	remi, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-remi", nil), "documents", "documents.collection", "read")
 	if err != nil || !covered(t, remi).All() {
 		t.Fatalf("an editor reads every collection: %v %v", remi, err)
 	}
-	if _, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.collection", "admin"); !errors.Is(err, issuer.ErrRefused) {
+	if _, err := k.Issuer.ListResources(ctx, named, "documents", "documents.collection", "admin"); !errors.Is(err, issuer.ErrRefused) {
 		t.Fatalf("an action the context does not hold: %v", err)
 	}
-	if _, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.nothing", "read"); err == nil {
+	if _, err := k.Issuer.ListResources(ctx, named, "documents", "documents.nothing", "read"); err == nil {
 		t.Fatal("a kind the module does not serve")
 	}
 }
 
-// A capability narrowed to named resources covers only those the owner's
-// grants cover: asking for an id never widens.
+// Asking for an id never widens: an ask naming one the owner's grants do not
+// cover is refused, even beside one they do, and a capability narrowed to
+// named resources covers exactly those.
 func TestANarrowedContextCoversOnlyTheIDsItNamesThatTheOwnerHolds(t *testing.T) {
 	k := testkit.New(t)
+	_, err := k.Issuer.Issue(person(t, k, "fixture-maya"), &authorityv1.IssueRequest{
+		As: &authorityv1.IssueRequest_Person{Person: &authorityv1.PersonSession{}}, Audience: "documents",
+		Scopes: []*authorityv1.WorkScopeV1{{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory", "secret"}}},
+	})
+	if !errors.Is(err, issuer.ErrRefused) || !strings.Contains(err.Error(), "widens") {
+		t.Fatalf("an ask naming an id the owner does not hold: %v", err)
+	}
 	token := issued(t, k, "fixture-maya", []*authorityv1.WorkScopeV1{
-		{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory", "secret"}},
+		{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory"}},
 	})
 	grants, err := k.Issuer.ListResources(context.Background(), token, "documents", "documents.collection", "read")
 	if err != nil {
diff --git a/modules/authority/services/local/code/pkg/business/state/composition_test.go b/modules/authority/services/local/code/pkg/business/state/composition_test.go
index d0e01042..bb3447f3 100644
--- a/modules/authority/services/local/code/pkg/business/state/composition_test.go
+++ b/modules/authority/services/local/code/pkg/business/state/composition_test.go
@@ -82,10 +82,18 @@ roles:
 	if err := k.State.AdmitMethod("ledger", "/ledger/Approve", mustHeld(t, k, "remi")); err == nil {
 		t.Error("the editor was admitted to the admin's method")
 	}
-	grants, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read")
-	if err != nil || len(grants) != 1 || grants[0].Prefix != "public-" {
+	// The viewer's grant keeps its prefix: she is issued an id it matches and
+	// refused one it does not, and an ask naming none carries none of it.
+	grants, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read", "public-1")
+	if err != nil || len(grants) != 1 || grants[0].ID != "public-1" {
 		t.Errorf("the viewer's grant keeps its resources: %v %v", grants, err)
 	}
+	if _, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read", "private-1"); err == nil || !strings.Contains(err.Error(), "what the owner holds") {
+		t.Errorf("the viewer's grant widened past its prefix: %v", err)
+	}
+	if _, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read"); err == nil {
+		t.Error("an empty ask carried the viewer's prefix as the whole kind")
+	}
 	// The fixture's own vocabulary stays.
 	if scopes := k.State.RoleScopes("acme", "viewer"); !state.Attenuates([]*basev0.WorkScopeV1{testkit.Scope("console.identity", "read")}, scopes) {
 		t.Errorf("the fixture's console grant was lost: %v", scopes)
diff --git a/modules/authority/services/local/code/pkg/business/state/permissions.go b/modules/authority/services/local/code/pkg/business/state/permissions.go
index 042efef9..7ccab5e5 100644
--- a/modules/authority/services/local/code/pkg/business/state/permissions.go
+++ b/modules/authority/services/local/code/pkg/business/state/permissions.go
@@ -140,14 +140,14 @@ func (s *State) PermissionReport() []string {
 			}
 		} else {
 			for _, role := range orgRoles {
-				roles[role.Name] = decide.OrgScopes([]domain.OrgRole{role}, m)
+				roles[role.Name] = decide.OrgScopes([]domain.OrgRole{role}, m, nil)
 			}
 		}
 		for method := range m.Methods {
 			covered := false
 			for role, scopes := range roles {
 				result := "covered statically; identity, installation and resource checks still apply"
-				if err := admitMethod(m, m.Principal, method, scopes); err != nil {
+				if err := classify(decide.AdmitMethod(m, method, scopes)); err != nil {
 					result = err.Error()
 				} else {
 					covered = true
diff --git a/modules/authority/services/local/code/pkg/business/state/state.go b/modules/authority/services/local/code/pkg/business/state/state.go
index d16c562f..be917e81 100644
--- a/modules/authority/services/local/code/pkg/business/state/state.go
+++ b/modules/authority/services/local/code/pkg/business/state/state.go
@@ -11,16 +11,14 @@ import (
 	"crypto/ed25519"
 	"errors"
 	"fmt"
-	"maps"
 	"slices"
-	"strings"
 	"sync"
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/memstore"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
-	"github.com/codefly-dev/authority/libraries/hop/go/routing"
 	resources "github.com/codefly-dev/authority/libraries/resources/go"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 	"github.com/codefly-dev/core/workloadidentity"
@@ -377,32 +375,10 @@ func compileScopes(r Role) error {
 	return nil
 }
 
-// ensureModuleInstallations holds a module installation at every organisation.
+// ensureModuleInstallations holds every composed module installed at every
+// organisation, through the core.
 func (s *State) ensureModuleInstallations() error {
-	return s.write(func(tx authority.Tx) error {
-		modules, err := tx.Modules()
-		if err != nil {
-			return err
-		}
-		orgs, err := tx.Organizations()
-		if err != nil {
-			return err
-		}
-		for _, m := range modules {
-			if m.Kind == domain.KindSolution {
-				continue
-			}
-			for _, org := range orgs {
-				id := InstallationID(org.ID, m.Name)
-				if _, err := tx.Installation(id); errors.Is(err, domain.ErrNotFound) {
-					if err := tx.PutInstallation(domain.Installation{ID: id, Organization: org.ID, Target: m.Name, Status: domain.Active, Revision: 1}); err != nil {
-						return err
-					}
-				}
-			}
-		}
-		return nil
-	})
+	return s.svc.ReconcileOrganizations(context.Background())
 }
 
 // performInstall installs what the fixture names through the core, then
@@ -560,13 +536,10 @@ func (s *State) ApplyManifest(m Manifest) ([]string, error) {
 	return ids, nil
 }
 
-// applyManifestLocked applies m through the core, what its methods require
-// joined to what it serves. Caller holds mu.
+// applyManifestLocked applies m through the core, which refuses an owner
+// anywhere in it and joins what its methods require to what it serves.
+// Caller holds mu.
 func (s *State) applyManifestLocked(m Manifest) ([]string, []FixtureInstallation, error) {
-	if err := noOwners(m); err != nil {
-		return nil, nil, err
-	}
-	m.ResourceKinds = Normalize(append(slices.Clone(m.ResourceKinds), servedByMethods(m.Methods)...))
 	ids, err := s.svc.ApplyModule(context.Background(), m)
 	if err != nil {
 		return nil, nil, classify(err)
@@ -575,55 +548,6 @@ func (s *State) applyManifestLocked(m Manifest) ([]string, []FixtureInstallation
 	return ids, s.takePendingInstalls(m.Name), nil
 }
 
-// noOwners refuses a delivery naming a resource owner where none belongs: in
-// what a module serves, in a binding's scopes, in a role or in a method's
-// requirement. An owner is the authority's to select per installation; read
-// owner-blind, it would widen to the whole kind, so it is refused by name.
-func noOwners(m Manifest) error {
-	check := func(where string, scopes []*basev0.WorkScopeV1) error {
-		for _, sc := range scopes {
-			if sc.GetResourceOwnerId() != "" {
-				return fmt.Errorf("%w: %s: %s names resource owner %q; a delivery never selects an owner", ErrForbidden, where, sc.GetResourceKind(), sc.GetResourceOwnerId())
-			}
-		}
-		return nil
-	}
-	if err := check(m.Name+" serves", m.ResourceKinds); err != nil {
-		return err
-	}
-	for _, id := range slices.Sorted(maps.Keys(m.Bindings)) {
-		b := m.Bindings[id]
-		for _, scopes := range [][]*basev0.WorkScopeV1{b.InvokeScopes, b.HeadlessScopes, b.LookupScopes} {
-			if err := check(m.Name+" binding "+id, scopes); err != nil {
-				return err
-			}
-		}
-	}
-	for _, name := range slices.Sorted(maps.Keys(m.Roles)) {
-		if err := check(m.Name+" role "+name, m.Roles[name]); err != nil {
-			return err
-		}
-	}
-	for _, method := range slices.Sorted(maps.Keys(m.Methods)) {
-		if err := check(m.Name+" method "+method, m.Methods[method].Requires); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// servedByMethods is every (kind, action) a module's methods require of a
-// call: what the module serves, read from its own method declarations.
-func servedByMethods(methods map[string]MethodPolicy) []*basev0.WorkScopeV1 {
-	var served []*basev0.WorkScopeV1
-	for _, policy := range methods {
-		for _, required := range policy.Requires {
-			served = append(served, &basev0.WorkScopeV1{ResourceKind: required.GetResourceKind(), Actions: slices.Clone(required.GetActions())})
-		}
-	}
-	return served
-}
-
 // takePendingInstalls removes and returns the fixture installations waiting
 // for target. Caller holds mu.
 func (s *State) takePendingInstalls(target string) []FixtureInstallation {
@@ -780,95 +704,11 @@ func (s *State) VerifyWorkload(ctx context.Context, credential string) (Manifest
 }
 
 // AdmitMethod applies what the module at audience declares for method to the
-// scopes a checked call holds. A method that declares nothing, or both that it
-// requires something and nothing, is refused: an absent or ambiguous
-// declaration is never read as permission.
+// scopes a checked call holds: the core's decide.AdmitMethod.
 func (s *State) AdmitMethod(audience, method string, held []*basev0.WorkScopeV1) error {
 	m, err := s.ModuleByPrincipal(audience)
 	if err != nil {
 		return err
 	}
-	return admitMethod(m, audience, method, held)
-}
-
-func admitMethod(m Manifest, audience, method string, held []*basev0.WorkScopeV1) error {
-	var err error
-	if m.Methods == nil {
-		return fmt.Errorf("%w: %s's delivery declares no method policy, so %s is refused", ErrForbidden, audience, method)
-	}
-	p, ok := m.Methods[method]
-	if !ok {
-		if p, ok, err = routeOf(m.Methods, method); err != nil {
-			return fmt.Errorf("%w: %s: %w", ErrForbidden, audience, err)
-		}
-	}
-	switch {
-	case !ok:
-		return fmt.Errorf("%w: %s serves no method %s", ErrUnknown, audience, method)
-	case p.AnyCheckedCaller && len(p.Requires) > 0:
-		return fmt.Errorf("%w: %s declares for %s both that it requires scopes and that it requires none", ErrForbidden, audience, method)
-	case p.AnyCheckedCaller:
-		return nil
-	case len(p.Requires) == 0:
-		return fmt.Errorf("%w: %s declares no policy for %s", ErrForbidden, audience, method)
-	}
-	// Method admission checks the kind and action; the module still checks
-	// each resource, and its owner, against the unchanged scopes.
-	var missing []string
-	for _, r := range p.Requires {
-		for _, action := range r.GetActions() {
-			if !HoldsAction(held, r.GetResourceKind(), action) {
-				missing = append(missing, r.GetResourceKind()+":"+action)
-			}
-		}
-	}
-	if len(missing) > 0 {
-		return fmt.Errorf("%w: %s requires %s for %s, which the call does not hold (it holds %s)",
-			ErrForbidden, audience, strings.Join(missing, ", "), method, describe(held))
-	}
-	return nil
-}
-
-// routeOf is the route a module declares that an HTTP request "<VERB> <path>"
-// is for; two templates matching one path is an ambiguous declaration,
-// refused rather than guessed between.
-func routeOf(methods map[string]MethodPolicy, request string) (MethodPolicy, bool, error) {
-	verb, path, ok := strings.Cut(request, " ")
-	if !ok || !strings.HasPrefix(path, "/") {
-		return MethodPolicy{}, false, nil
-	}
-	var found []string
-	for declared := range methods {
-		if v, template, ok := strings.Cut(declared, " "); ok && v == verb && routing.RouteMatches(template, path) {
-			found = append(found, declared)
-		}
-	}
-	switch len(found) {
-	case 0:
-		return MethodPolicy{}, false, nil
-	case 1:
-		return methods[found[0]], true, nil
-	}
-	slices.Sort(found)
-	return MethodPolicy{}, false, fmt.Errorf("%s matches more than one declared route (%s)", request, strings.Join(found, ", "))
-}
-
-func describe(held []*basev0.WorkScopeV1) string {
-	var out []string
-	for _, h := range held {
-		for _, a := range h.GetActions() {
-			permission := h.GetResourceKind() + ":" + a
-			switch {
-			case h.GetResourceOwnerId() != "":
-				permission += " (owner-selected)"
-			case len(h.GetResourceIds()) > 0:
-				permission += " (resource-limited)"
-			}
-			out = append(out, permission)
-		}
-	}
-	if len(out) == 0 {
-		return "nothing"
-	}
-	return strings.Join(out, ", ")
+	return classify(decide.AdmitMethod(m, method, held))
 }
diff --git a/modules/authority/services/local/code/pkg/business/testkit/person.go b/modules/authority/services/local/code/pkg/business/testkit/person.go
index e378ef6d..a1aa0c27 100644
--- a/modules/authority/services/local/code/pkg/business/testkit/person.go
+++ b/modules/authority/services/local/code/pkg/business/testkit/person.go
@@ -13,9 +13,10 @@ import (
 	authorityv1 "gateway/pkg/gen/host/authority/v1"
 )
 
-// PersonIssue is what person is issued at audience asking for everything
-// they hold there, through the wire: signed in by their fixture token.
-func (k *Kit) PersonIssue(t *testing.T, person, audience string) (*authorityv1.IssueResponse, error) {
+// PersonIssue is what person is issued at audience asking for scopes, or
+// everything they hold there when none, through the wire: signed in by their
+// fixture token.
+func (k *Kit) PersonIssue(t *testing.T, person, audience string, scopes ...*authorityv1.WorkScopeV1) (*authorityv1.IssueResponse, error) {
 	t.Helper()
 	token := ""
 	for _, p := range k.State.FixturePeople() {
@@ -28,7 +29,7 @@ func (k *Kit) PersonIssue(t *testing.T, person, audience string) (*authorityv1.I
 		t.Fatalf("sign in %s: %v", person, err)
 	}
 	return k.Issuer.Issue(issuer.WithSession(context.Background(), sess.ID), &authorityv1.IssueRequest{
-		As: &authorityv1.IssueRequest_Person{Person: &authorityv1.PersonSession{}}, Audience: audience})
+		As: &authorityv1.IssueRequest_Person{Person: &authorityv1.PersonSession{}}, Audience: audience, Scopes: scopes})
 }
 
 // PersonScopes is what person holds at audience now: the effective scopes of
@@ -48,10 +49,15 @@ func (k *Kit) PersonScopes(t *testing.T, person, audience string) ([]*basev0.Wor
 }
 
 // ResourceGrants is which resources of kind person may act on with action at
-// audience, as the authority answers it for their capability.
-func (k *Kit) ResourceGrants(t *testing.T, person, audience, kind, action string) ([]authority.Grant, error) {
+// audience, as the authority answers it for their capability: one asking for
+// action on ids when it names any, else for everything they hold.
+func (k *Kit) ResourceGrants(t *testing.T, person, audience, kind, action string, ids ...string) ([]authority.Grant, error) {
 	t.Helper()
-	out, err := k.PersonIssue(t, person, audience)
+	var ask []*authorityv1.WorkScopeV1
+	if len(ids) > 0 {
+		ask = append(ask, &authorityv1.WorkScopeV1{ResourceKind: kind, Actions: []string{action}, ResourceIds: ids})
+	}
+	out, err := k.PersonIssue(t, person, audience, ask...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml b/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml
index 539f3abb..98ecc5f5 100644
--- a/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml
+++ b/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml
@@ -19,8 +19,10 @@ roles:
       - {kind: evaluation.runs, actions: [read]}
       - {kind: evaluation.online, actions: [read]}
       # A viewer reads only some document collections: the directory's, the
-      # wiki's, and every shared one. The authority answers this when asked
-      # (ListResources); the token carries the kind alone. A collection's id
+      # wiki's, and every shared one. A token cannot carry a prefix or a
+      # pattern, and never carries them as the whole kind: the viewer is issued
+      # the collections an ask names that they match, and an ask naming none
+      # carries none of the kind. A collection's id
       # is the store's namespace, "derived" and its producer joined by a unit
       # separator (\x1f).
       - kind: documents.collection
diff --git a/modules/authority/services/local/code/plugins/composition/plugin.go b/modules/authority/services/local/code/plugins/composition/plugin.go
index d0765ff5..1824eec0 100644
--- a/modules/authority/services/local/code/plugins/composition/plugin.go
+++ b/modules/authority/services/local/code/plugins/composition/plugin.go
@@ -7,10 +7,9 @@ import (
 	"gateway/pkg/framework"
 	"gateway/pkg/wiring"
 	"log"
-	"strings"
 
-	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
-	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/delivered"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
 	"github.com/codefly-dev/core/solutionhost"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -65,44 +64,23 @@ func (p *Plugin) ApplyManifest(ctx context.Context, req *compositionv1.ApplyMani
 		return nil, err
 	}
 	var sidecar []byte
-	delivered, err := carrier.Manifest()
+	manifest, err := carrier.Manifest()
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "manifest: %v", err)
 	}
-	m := FromCore(delivered)
+	var doc *delivered.Document
 	if req.GetAuthority() != nil {
-		doc, err := p.document(req.GetAuthority(), req.GetCarrier(), delivered, carrier.Signer().KeyID)
-		if err != nil {
-			return nil, err
-		}
-		if delivered.Removed && (len(doc.GetMethods()) > 0 || len(doc.GetRoles()) > 0 || len(doc.GetScopeCeilings()) > 0) {
-			return nil, status.Error(codes.InvalidArgument, "a withdrawal carries no live authority declarations")
+		if doc, err = p.document(req.GetAuthority(), req.GetCarrier(), manifest, carrier.Signer().KeyID); err != nil {
+			return nil, authorityplugin.Status(err)
 		}
 		sidecar = req.GetAuthority().GetDocument()
 		if sidecar == nil {
 			sidecar = []byte{}
 		}
-		if m.Methods, err = methodsOf(doc); err != nil {
-			return nil, err
-		}
-		for _, ceiling := range doc.GetScopeCeilings() {
-			if ceiling.GetResourceOwnerId() != "" {
-				return nil, status.Errorf(codes.PermissionDenied, "%s: scope ceiling %s names resource owner %q; a delivery never selects an owner", m.Name, ceiling.GetResourceKind(), ceiling.GetResourceOwnerId())
-			}
-		}
-		if m, err = ceiled(m, issuer.FromWire(doc.GetScopeCeilings())); err != nil {
-			return nil, err
-		}
-		m.OwnedRoles = map[string][]*basev0.WorkScopeV1{}
-		for _, role := range doc.GetRoles() {
-			if len(role.GetInstallationOwnedScopes()) > 0 {
-				m.OwnedRoles[role.GetName()] = issuer.FromWire(role.GetInstallationOwnedScopes())
-			}
-		}
-		if m.Roles, err = rolesOf(doc); err != nil {
-			return nil, err
-		}
-		m.OwnerAware = doc.GetOwnerAware()
+	}
+	m, err := delivered.Module(manifest, doc)
+	if err != nil {
+		return nil, authorityplugin.Status(err)
 	}
 	ids, err := p.State.ApplyDelivered(ctx, p.Coordinate, carrier, sidecar, m)
 	if err != nil {
@@ -139,144 +117,35 @@ func (p *Plugin) verified(ctx context.Context, carrier *compositionv1.SignedMani
 
 // document reads the authority's document delivered with a verified carrier:
 // signed by the key that signed the carrier, for the same module and
-// generation, naming the carrier's digest. Anything else is refused, so a
-// delivery cannot pair one release's manifest with another's method policy.
-func (p *Plugin) document(signed, carrier *compositionv1.SignedManifestV1, core *solutionhost.ModuleManifest, signer string) (*compositionv1.AuthorityManifestV1, error) {
-	keyID, err := delivery.Verify(signed.GetDocument(), signed.GetEnvelope(), p.Keys)
-	if err != nil {
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document does not verify: %v", err)
-	}
-	if keyID != signer {
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document is signed by %q and the manifest by %q", keyID, signer)
-	}
-	var doc compositionv1.AuthorityManifestV1
-	if err := proto.Unmarshal(signed.GetDocument(), &doc); err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "the authority's document does not read: %v", err)
-	}
-	switch {
-	case doc.GetModule() != core.Alias:
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document is for %q, the manifest for %q", doc.GetModule(), core.Alias)
-	case doc.GetGeneration() != core.Generation:
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document is at generation %d, the manifest at %d", doc.GetGeneration(), core.Generation)
-	case doc.GetCoreManifestDigest() != delivery.Digest(carrier.GetDocument()):
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document names another manifest than the one delivered with it")
-	}
-	return &doc, nil
-}
-
-// methodsOf reads what each method declares.
-func methodsOf(doc *compositionv1.AuthorityManifestV1) (map[string]state.MethodPolicy, error) {
-	methods := make(map[string]state.MethodPolicy, len(doc.GetMethods()))
-	for _, method := range doc.GetMethods() {
-		if _, twice := methods[method.GetMethod()]; twice || method.GetMethod() == "" {
-			return nil, status.Errorf(codes.InvalidArgument, "the authority's document lists method %q twice or unnamed", method.GetMethod())
-		}
-		methods[method.GetMethod()] = state.MethodPolicy{Requires: issuer.FromWire(method.GetRequires()), AnyCheckedCaller: method.GetAnyCheckedCaller()}
-	}
-	return methods, nil
-}
-
-// rolesOf reads the roles a solution declares, by name. The state holds them to
-// the role contract: a solution declares an installer and every role stays
-// within what it serves or explicitly consumes through invoke/lookup bindings,
-// and a module declares none, so a
-// module's delivery listing any is refused there by name.
-func rolesOf(doc *compositionv1.AuthorityManifestV1) (map[string][]*basev0.WorkScopeV1, error) {
-	if len(doc.GetRoles()) == 0 {
-		return nil, nil
-	}
-	roles := make(map[string][]*basev0.WorkScopeV1, len(doc.GetRoles()))
-	for _, role := range doc.GetRoles() {
-		if _, twice := roles[role.GetName()]; twice || role.GetName() == "" {
-			return nil, status.Errorf(codes.InvalidArgument, "the authority's document lists role %q twice or unnamed", role.GetName())
-		}
-		roles[role.GetName()] = state.Normalize(issuer.FromWire(role.GetScopes()))
-	}
-	return roles, nil
-}
-
-// ceiled gives each of the module's own kinds the actions its contract declares
-// on it, in place of the any-action kind core's manifest leaves it with. A
-// ceiling naming a kind core's manifest does not declare is refused: the
-// authority's document narrows what core's manifest composes, never adds to it.
-func ceiled(m state.Manifest, ceilings []*basev0.WorkScopeV1) (state.Manifest, error) {
-	if len(ceilings) == 0 {
-		return m, nil
-	}
-	declared := map[string]bool{}
-	for _, kind := range m.ResourceKinds {
-		declared[kind.GetResourceKind()] = true
-	}
-	ceiled := map[string]bool{}
-	for _, ceiling := range ceilings {
-		if !declared[ceiling.GetResourceKind()] {
-			return m, status.Errorf(codes.InvalidArgument, "the authority's document ceils %s, which %s's manifest does not declare", ceiling.GetResourceKind(), m.Name)
-		}
-		if len(ceiling.GetActions()) == 0 {
-			return m, status.Errorf(codes.InvalidArgument, "the authority's document ceils %s with no action", ceiling.GetResourceKind())
-		}
-		ceiled[ceiling.GetResourceKind()] = true
-	}
-	kinds := append([]*basev0.WorkScopeV1(nil), ceilings...)
-	for _, kind := range m.ResourceKinds {
-		if !ceiled[kind.GetResourceKind()] {
-			kinds = append(kinds, kind)
-		}
-	}
-	m.ResourceKinds = state.Normalize(kinds)
-	return m, nil
-}
-
-// FromCore reads core's module manifest as the state's. Core's manifest carries
-// no roles; a solution's arrive in the authority's document delivered with it
-// (rolesOf), so a solution delivered as a carrier with none is refused. The
-// manifest is the ceiling here: a resource kind declared with no actions serves
-// whatever the roles grant on it, a binding's invoke scopes are its operations,
-// and a module acting alone holds what it may invoke. The host narrows each of
-// these by its release-signed envelope; the local authority has no second
-// document.
-func FromCore(in *solutionhost.ModuleManifest) state.Manifest {
-	m := state.Manifest{Name: in.Alias, Principal: in.Alias, Kind: string(in.Kind), Generation: in.Generation, Bindings: map[string]state.Binding{}}
-	if in.Authority == nil {
-		return m
-	}
-	if in.Authority.Principal != "" {
-		m.Principal = in.Authority.Principal
+// generation, naming the carrier's digest (delivered.VerifyDocument and
+// delivered.Pair). Anything else is refused, so a delivery cannot pair one
+// release's manifest with another's method policy.
+func (p *Plugin) document(signed, carrier *compositionv1.SignedManifestV1, core *solutionhost.ModuleManifest, signer string) (*delivered.Document, error) {
+	if err := delivered.VerifyDocument(signed.GetDocument(), signed.GetEnvelope(), p.Keys, signer); err != nil {
+		return nil, err
 	}
-	for _, kind := range in.Authority.ResourceKinds {
-		m.ResourceKinds = append(m.ResourceKinds, &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{state.AnyAction}})
+	var wire compositionv1.AuthorityManifestV1
+	if err := proto.Unmarshal(signed.GetDocument(), &wire); err != nil {
+		return nil, domain.Malformed("the authority's document does not read: %v", err)
 	}
-	m.ResourceKinds = state.Normalize(m.ResourceKinds)
-	for _, b := range in.Authority.Bindings {
-		invoke := scopesOf(b.Operations["invoke"])
-		headless := scopesOf(b.Operations["headless"])
-		lookup := scopesOf(b.Operations["lookup"])
-		m.Bindings[b.ID] = state.Binding{ID: b.ID, Audience: b.Audience, InvokeScopes: invoke, HeadlessScopes: headless, LookupScopes: lookup}
+	doc := DocumentOf(&wire)
+	if err := delivered.Pair(*doc, carrier.GetDocument(), core); err != nil {
+		return nil, err
 	}
-	return m
+	return doc, nil
 }
 
-// scopesOf reads one operation's requested scopes, each "<resource kind>:<action>"
-// as core's manifest writes them, into scopes grouped by kind. An entry without
-// a colon names nothing and is skipped; the manifest's own validation refuses it.
-func scopesOf(entries []string) []*basev0.WorkScopeV1 {
-	byKind := map[string][]string{}
-	var kinds []string
-	for _, entry := range entries {
-		kind, action, ok := strings.Cut(entry, ":")
-		if !ok || kind == "" || action == "" {
-			continue
-		}
-		if _, seen := byKind[kind]; !seen {
-			kinds = append(kinds, kind)
-		}
-		byKind[kind] = append(byKind[kind], action)
+// DocumentOf reads this host's binding of the authority's document as the core's.
+func DocumentOf(in *compositionv1.AuthorityManifestV1) *delivered.Document {
+	doc := &delivered.Document{Module: in.GetModule(), Generation: in.GetGeneration(), CoreManifestDigest: in.GetCoreManifestDigest(),
+		ScopeCeilings: issuer.FromWire(in.GetScopeCeilings()), OwnerAware: in.GetOwnerAware()}
+	for _, m := range in.GetMethods() {
+		doc.Methods = append(doc.Methods, delivered.Method{Method: m.GetMethod(), Requires: issuer.FromWire(m.GetRequires()), AnyCheckedCaller: m.GetAnyCheckedCaller()})
 	}
-	var out []*basev0.WorkScopeV1
-	for _, kind := range kinds {
-		out = append(out, &basev0.WorkScopeV1{ResourceKind: kind, Actions: byKind[kind]})
+	for _, r := range in.GetRoles() {
+		doc.Roles = append(doc.Roles, delivered.Role{Name: r.GetName(), Scopes: issuer.FromWire(r.GetScopes()), InstallationOwned: issuer.FromWire(r.GetInstallationOwnedScopes())})
 	}
-	return state.Normalize(out)
+	return doc
 }
 
 // New is the registry's constructor: the plugin over what Configure wired.
diff --git a/modules/authority/services/local/code/plugins/composition/plugin_test.go b/modules/authority/services/local/code/plugins/composition/plugin_test.go
deleted file mode 100644
index 011e9a6a..00000000
--- a/modules/authority/services/local/code/plugins/composition/plugin_test.go
+++ /dev/null
@@ -1,70 +0,0 @@
-package composition
-
-import (
-	"slices"
-	"testing"
-
-	"gateway/pkg/business/state"
-
-	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
-	"github.com/codefly-dev/core/solutionhost"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-// Core's manifest writes a binding's operations as operation → "<kind>:<action>"
-// entries; the state reads invoke and headless scopes from them.
-func TestCoreBindingOperationsAreReadAsScopesPerOperation(t *testing.T) {
-	m := FromCore(&solutionhost.ModuleManifest{Alias: "robin", Kind: solutionhost.KindModule, Generation: 1,
-		Authority: &solutionhost.Authority{Principal: "robin", Bindings: []solutionhost.AuthorityBinding{{
-			ID: "model", Audience: "model",
-			Operations: map[string][]string{
-				"invoke":   {"modelservice.profiles:invoke", "modelservice.profiles:read"},
-				"lookup":   {"modelservice.profiles:read"},
-				"headless": {"modelservice.profiles:read"},
-			},
-		}}}})
-	b, ok := m.Bindings["model"]
-	if !ok || b.Audience != "model" {
-		t.Fatalf("binding: %+v", m.Bindings)
-	}
-	if len(b.InvokeScopes) != 1 || b.InvokeScopes[0].GetResourceKind() != "modelservice.profiles" || len(b.InvokeScopes[0].GetActions()) != 2 {
-		t.Fatalf("invoke scopes: %v", b.InvokeScopes)
-	}
-	if len(b.HeadlessScopes) != 1 || b.HeadlessScopes[0].GetActions()[0] != "read" {
-		t.Fatalf("headless scopes: %v", b.HeadlessScopes)
-	}
-}
-
-// A module's own kinds come from core's manifest as names; the authority's
-// document gives each the actions the contract declares, so a person who holds
-// everything there is granted those actions rather than an action nobody can
-// enumerate.
-func TestScopeCeilingsGiveTheModulesKindsTheirActions(t *testing.T) {
-	m := FromCore(&solutionhost.ModuleManifest{Alias: "runtime", Kind: solutionhost.KindModule, Generation: 1,
-		Authority: &solutionhost.Authority{Principal: "runtime", ResourceKinds: []string{"runtime.tasks", "runtime.queues"}}})
-	got, err := ceiled(m, []*basev0.WorkScopeV1{{ResourceKind: "runtime.tasks", Actions: []string{"start", "execute"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	actions := map[string][]string{}
-	for _, kind := range got.ResourceKinds {
-		actions[kind.GetResourceKind()] = kind.GetActions()
-	}
-	if len(actions["runtime.tasks"]) != 2 || slices.Contains(actions["runtime.tasks"], state.AnyAction) {
-		t.Fatalf("runtime.tasks serves %v", actions["runtime.tasks"])
-	}
-	// A kind the document does not ceil keeps what core's manifest gave it.
-	if !slices.Equal(actions["runtime.queues"], []string{state.AnyAction}) {
-		t.Fatalf("runtime.queues serves %v", actions["runtime.queues"])
-	}
-	// The document narrows what core composes and never adds a kind.
-	for name, ceilings := range map[string][]*basev0.WorkScopeV1{
-		"a kind core does not declare": {{ResourceKind: "records.records", Actions: []string{"write"}}},
-		"a kind with no action":        {{ResourceKind: "runtime.tasks"}},
-	} {
-		if _, err := ceiled(m, ceilings); status.Code(err) != codes.InvalidArgument {
-			t.Errorf("%s: %v", name, err)
-		}
-	}
-}
diff --git a/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go b/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go
index 4f4def99..d56059d5 100644
--- a/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go
+++ b/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go
@@ -177,9 +177,11 @@ people:
 			Ambiguous: conformance.WorkloadOrganizationCase{Credential: k.Credential(t, "org-directory"), Module: "org-directory", Binding: "records", Audience: "records"},
 			None:      conformance.WorkloadOrganizationCase{Credential: k.Credential(t, "runtime"), Module: "runtime", Binding: "model", Audience: "model"},
 		},
-		LocalAdvisory: true,
-		OwnerToken:    "fixture-owner",
-		SlowChecks:    true,
+		LocalAdvisory:   true,
+		OwnerToken:      "fixture-owner",
+		OtherAdminToken: "fixture-zoe",
+		HopCredential:   k.HopCredential(t),
+		SlowChecks:      true,
 		SolutionRoles: &conformance.SolutionRoleCase{
 			Solution: "wiki", Credential: k.Credential(t, "wiki"), Token: "fixture-maya", Outsider: "fixture-no-roles",
 			OwnKind: "wiki.page", OwnActions: []string{"read", "write", "publish"},
diff --git a/playground/configurations/local/fixture-composition.yaml b/playground/configurations/local/fixture-composition.yaml
index 38dc5fbd..f48c0b84 100644
--- a/playground/configurations/local/fixture-composition.yaml
+++ b/playground/configurations/local/fixture-composition.yaml
@@ -12,9 +12,11 @@ roles:
       - {kind: records.types, actions: [read]}
       - {kind: directory.entry, actions: [read]}
       # A viewer reads only some document collections: the directory's and every
-      # shared one. The authority answers this when asked (ListResources); the
-      # token carries the kind alone. A collection's id is the store's namespace,
-      # "derived" and its producer joined by a unit separator (\x1f).
+      # shared one. A token cannot carry a prefix or a pattern, and never carries
+      # them as the whole kind: the viewer is issued the collections an ask names
+      # that they match, and an ask naming none carries none of the kind. A
+      # collection's id is the store's namespace, "derived" and its producer
+      # joined by a unit separator (\x1f).
       - kind: documents.collection
         actions: [read]
         resources: