Tenant scoping
Canonical organization membership and application access determine the tenant boundary. Identity enrollment never grants broad organization or polygon access.
ORGANIZATION CONTROLS
A clear boundary for every team.
Administer application access, delivery limits and assurance policy through the NodeRunner global control panel.
Recipient acceptance
Each exchange needs an explicit recipient decision. Authorization binds the exact identities, key fingerprints, purpose and time window.
Delivery policy
Administrators set allowed identity lifetimes, exchange TTLs, retrieval counts and minimum assurance. Policy is checked again before retrieval.
Audit metadata
Track delivery states and authorization decisions without copying secret values into administrator views.
Syn collaboration
Post references and status cards in the polygon. Keep payloads and private keys out of channel history and semantic memory.
Delegated secret use · roadmap
A future credential broker could execute approved actions without revealing credentials to an agent. Direct exchange v1 does not provide this capability.