Minimal database model
owners
id
tenant_id
username
email
email_verified_at
password_hash
scope                  system | tenant
provisioning_source
status
created_at
owner_sessions
id
owner_id
token_hash
created_at
last_seen_at
expires_at
step_up_at
revoked_at
tenants
id
display_name
status
created_at
frozen_at
logical_keys
id
credential_id
tenant_id
parent_key_id
created_by_owner_id
created_by_key_id
key_type
label
status
bootstrap_mode
activated_at
suspended_at
revoked_at
created_at

Use one parent per logical Key in the MVP. Multiple-parent or graph delegation can be introduced later.

key_components
id
logical_key_id
purpose                 authentication | delegation | authorship | box
version
algorithm
public_key
fingerprint
status
valid_from
valid_until
compromised_at
retired_at

Retain old public components so historical signatures remain verifiable.

key_policy_versions
id
logical_key_id
version
canonical_policy
policy_hash
created_by_owner_id
created_by_key_id
created_at
superseded_at

Policies are immutable. A change creates a new policy version.

claim_slots
id
logical_key_id
component_purpose
claim_token_hash
confirmation_code_hash
destination_hint
expires_at
claimed_at
cancelled_at
registered_public_key
used_nonces
logical_key_id
nonce_hash
used_at
expires_at

Unique constraint:

(logical_key_id, nonce_hash)
authored_objects
id
tenant_id
logical_key_id
object_type
content_digest
canonical_metadata
author_signature
auth_component_version
author_component_version
created_at
withdrawn_at
events
id
tenant_id
actor_kind
actor_id
subject_kind
subject_id
action
decision
reason_code
canonical_details
previous_event_hash
event_hash
created_at

The hash chain makes rewriting more detectable, but it should not be advertised as tamper-proof while an administrator controlling the database can rewrite the entire chain.

alerts
id
tenant_id
logical_key_id
severity
type
details
created_at
acknowledged_at
resolved_at
outbox
id
message_type
destination
payload
attempt_count
next_attempt_at
sent_at