Build one stateful authorization monolith with two sharply separated surfaces:




Owner Control Plane
A human-facing web application used only by Owner accounts.

A human-authenticated browser interface used for:

Account administration.
Creating Primary Authors.
Setting initial permission ceilings.
Viewing lineage.
Viewing provenance.
Reviewing activity.
Receiving alerts.
Suspending and revoking Keys.
Rotating components.
Freezing branches or the tenancy.



Key Execution Plane
A signed-request API used only by Primary Author, Secondary Author, Use, and Keyring credentials.

An API-only surface authenticated by cryptographic signatures.

It must never accept:

Owner cookies.
Owner passwords.
Owner email authentication.
Bearer use of the Credential ID.



The server should store:

Owner authentication records.
Credential IDs.
Public keys.
Parent/child relationships.
Signed grants.
Effective permissions.
Revocation and rotation status.
Audit history.
Replay-prevention records.
Alerts.





CRE8 Credential Bundle

credential_id
assertion_private_key
assertion_public_key
delegation_private_key
delegation_public_key
access_private_key
access_public_key
control_private_key
control_public_key