Add governed encryption administration

docs/ENCRYPTION_BOUNDARY.md

@@ -36,6 +36,27 @@ an ownership transfer does not transfer cryptographic custody.
 
 No capability in this module accepts or returns plaintext key material.
 
+## Administration Surface
+
+Tenant encryption custodians can inspect bounded vault, envelope, migration,
+recovery, and disable-preflight summaries. These read models deliberately omit
+provider key references, wrapped-key references, ciphertext locations, and
+cryptographic material. They are tenant-scoped and bounded to prevent the
+operator interface from becoming an unrestricted metadata export.
+
+Vault lifecycle actions require optimistic revision, policy-decision, recent
+assurance, reason, and idempotency evidence. Rotation does not silently migrate
+old envelopes. Revocation and scheduled destruction explain that prior
+plaintext cannot be recalled and that content may become unavailable. A
+migration request only authorizes the operation: the feature module that owns
+the content must durably apply it and record evidence before success. Provider
+outcome reconciliation never converts an unknown outcome into success without
+that evidence.
+
+Recovery requests show quorum, distinct-custodian, expiry, and requester
+separation requirements. Approval authorizes a later provider-specific action;
+it does not return keys, change resource ownership, or prove execution.
+
 ## Assets and Threat Actors
 
 Protected assets include content plaintext, data-encryption keys, wrapping keys,