Design 58: the identity store is read by grant, and sessions never call through the tool runner's login (review round 1)

03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md

@@ -93,7 +93,8 @@ owns it. Claude Code's own built-in tools, its command tool included, are turned
 
 The identity seat, held once for the mesh, owns every **identity** (a person, an agent or a module) and every
 **role**, in the bus's key-value store. An identity has a name, a kind, a role and whether it is switched on. They
-change only through the seat's verbs, each recorded with who asked; anything may watch the store live. Only the
+change only through the seat's verbs, each recorded with who asked; a module or front end whose role grants the
+seat's reads may watch the store live, and it holds no secret. Only the
 operator creates a person or an agent, or changes its role. A module's identity is asked for by the controller when
 the module is assigned to a node, named by machine and module, with a role made from what its manifest declares it
 calls.
@@ -102,7 +103,8 @@ A role holds **grants**. A grant is an effect everywhere, an effect on one seat,
 limited to named machines. Two fences check them: the bus, coarsely, by seat and module, from the role's signing
 key; and the tool runner, exactly, tool by tool, in the SDK. Every call carries its thread; a module acting for an
 agent carries a token the identity seat signed for that agent, and the tool runner then checks the agent's role. A
-refusal names the missing grant; every call is recorded with its identity and thread.
+refusal names the missing grant; every call is recorded with its identity and thread. A session on an operator's
+machine calls as the operator's person identity or as an agent, never through the machine's tool-runner login.
 
 ## 6. Effects, asks and break-glass (ADR 0387)