Permission boundaries mapped to protocol responsibilities

Role	Scopes
Owner	billing + risk + keys + rbac
Operator	sessions + endpoints + events
Security	events + evidence + policy