System Admin Owner

The first Owner has:

owner_scope = system

It can:

Create gift Owner accounts.
Activate manually paid Owner accounts.
Suspend Owner accounts.
Enter a tenancy oversight view.
Review system alerts.
Review all public key and audit information.

Entering another tenant should require:

Step-up authentication.
A reason.
A visibly different UI state.
A mandatory event record.
A short oversight-session expiry.

The System Admin Owner can inspect server-held information but cannot impersonate an Author because CRE8 does not possess Author private keys.









Tenant Owner

Every subsequent Owner normally has:

owner_scope = tenant

It has total human administrative authority over that tenant, subject to system safety controls.

Gift and paid designation

Store an internal value such as:

provisioning_source:
  - system_gift
  - commercial
  - migration
  - development

This field must not:

Appear in API responses.
Appear in permission evaluation.
Change rate limits.
Change security.
Change features.
Change Owner or Key authority.

Actual payment processing can be omitted from the first MVP. The System Admin Owner can create both internal account categories manually.