See It Work — Partners and investors see exactly what you authorized — nothing more | S2 Vol 4 · Federation & Partner Device Gateway

Federations include partners and investors who need access to some of your surfaces. The danger is access that quietly grows. Here, each partner's scope is a clause in your rulebook — 'this investor sees per-quarter yield reports' — and the system enforces it. Widening the scope isn't a setting someone can flip; it requires a ceremony.

Access-control lists drift — a permission added 'just this once' becomes permanent and forgotten. A Charter scope enforced at the system layer can't silently widen, and every access it does grant leaves a receipt.

What this means for you

Partners see exactly the scope you wrote down — enforced structurally, never quietly widened, always receipted. What this means for you: you can bring in investors and partners without losing control of your surfaces — their access can't creep, and you can prove at any time exactly what each one could see.

Each partner's access is a Charter scope the system enforces — and receipts:

Scoped Access

scopea clause in your rulebook

can it silently widen?no — widening needs a ceremony

every accessleaves a receipt

QuadRoof investorverifies evidence in minutes, independently

Access-control lists drift; a Charter scope enforced at the harness layer does not.

For the technical reader — the command, and how to verify it yourself

# one line · you do not need to run this
see walkthrough

./bl-verify
# -> partner access held exactly to its Charter scope

Full step-by-step is in Appendix RX: Hands-On Demonstrations in the book.