Security boundaries

c6s separates four events that ordinary onboarding can make look like one:

1. Account authentication proves a Google or Apple identity to the hosted service.
2. Device enrollment decides whether a local device receives trusted capability.
3. Vault unlock makes protected local key material usable after local policy.
4. Operation approval signs one immutable target, input set, scope, and expiry.

Passing one boundary never implies that the next boundary passed.

Web boundary

The public site and Console do not decrypt, reveal, copy, or execute with vault secrets. Console is limited to non-secret account, device, and request-coordination state accepted by the current API contract.

Agent boundary

An agent should receive a typed reference or a limited capability instead of a raw secret whenever practical. A future mutation must offer an exact preview and use the same human authorization as its CLI equivalent.

Private-beta assurance

The current design is a candidate security model, not an external audit or production assurance claim. Unsupported operations are intentionally unavailable rather than simulated.