diff --git a/docs/ENCRYPTION_BOUNDARY.md b/docs/ENCRYPTION_BOUNDARY.md
index 1aa6105..273a210 100644
--- a/docs/ENCRYPTION_BOUNDARY.md
+++ b/docs/ENCRYPTION_BOUNDARY.md
@@ -18,6 +18,37 @@ certification claim. Stronger claims require a named protection profile whose
 provider, clients, algorithms, backup procedure, and failure tests have passed
 the profile's conformance and security review.
 
+## Approved Product Baseline
+
+The product decision recorded on 2026-08-04 separates module activation from
+content protection. Enabling Encryption makes its capabilities and
+administration available but never encrypts existing or new content by itself.
+
+- System definitions are reusable profile templates. Tenants explicitly
+  activate profiles for an owner-module collection or individual object.
+  Accounts and groups remain policy subjects rather than cryptographic scopes.
+- New objects inherit protection only inside an explicitly activated scope.
+  Existing objects move through an explicit, checkpointed, copy-on-write
+  migration with verified cutover.
+- The first production profile is managed server-envelope encryption backed by
+  a KMS/HSM provider. The bundled local provider remains a bounded reference
+  implementation. Tenant-held and client E2EE profiles require separate
+  provider approval and conformance evidence.
+- Recovery defaults to a high-assurance, distinct-custodian 2-of-3 quorum with
+  requester separation. Ordinary platform administration does not bypass the
+  ceremony.
+- Horizontally scaled nodes may receive only short-lived, in-memory unwrap
+  grants. They do not persist usable key material on node-local storage.
+- Disable remains blocked until every protected object is verifiably decrypted,
+  migrated, exported, or destroyed. Externally opaque ciphertext must be
+  resolved through its provider before the owning profile can be removed.
+
+After a migration has retired plaintext, reversal is another governed
+migration rather than retention of an undisclosed plaintext rollback copy.
+True E2EE is deliberately not part of the first production profile because it
+changes search, server-side processing, inspection, reporting, legal-hold
+export, and recovery guarantees.
+
 ## Ownership Boundary
 
 Encryption owns: