Suggested default Key profiles
Primary Author — Branch Administrator

Default self permissions:

Read its own branch.
Mint Secondary, Use, and Keyring Keys.
Define narrower child policies.
Sign and publish authored objects.
Issue credentials.
Create shares and messages.
Read descendant audit and alerts.
Suspend and revoke direct descendants.
Rotate descendants within its branch.

Defaults:

mint_primary: false
mint_secondary: true
mint_use: true
mint_keyring: true

max_additional_primary: 0
max_active_secondary: 20
max_active_use: 100
max_active_keyring: 10
max_delegation_depth: 3

Enabling additional Primary Authors should require an explicit Owner selection.

Additional Primary Author — Branch Root

Similar to the original Primary Author, but default its visibility to:

self + descendants

Do not automatically grant tenant-wide audit, tenant-wide directory management, or authority over sibling Primary Authors.

Secondary Author — Scoped Publisher or Issuer

Default:

Create and publish within assigned namespaces.
Issue scoped credentials.
Send messages.
Create shares.
Mint scoped Use and Keyring Keys.
Read its own descendants.
Suspend its direct children.

Defaults:

mint_primary: false
mint_secondary: false
mint_use: true
mint_keyring: true
max_delegation_depth: 1
Use Key — Operational leaf

Default:

Exact actions only.
Exact resource or namespace scope.
Short expiry.
No child minting.
No policy administration.
No descendant audit.
No branch suspension.
No delegation.

Suggested starting maximum lifetime:

30 days

Longer duration requires an explicit choice.

Keyring Key — Custody leaf

Default:

Retrieve specifically scoped encrypted keyring packages.
Update its own keyring metadata.
Rotate its Box component.
No authorship.
No credential issuance.
No operational API authority.
No delegation.