diff --git a/AGENTS.md b/AGENTS.md
index 54d21f2..211c6b6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,11 @@
 # GovOPlaN Encryption Codex Guide
 
+## Documentation Contract
+
+- Treat documentation as part of every behavior change. Update this module's manifest-driven `DocumentationTopic` contributions for affected user and administrator behavior.
+- Keep feature content here; `govoplan-docs` projects it without importing Encryption internals.
+- Maintain a static user/admin baseline and run `/mnt/DATA/git/govoplan/tools/checks/check-manifest-shapes.py` after behavior or manifest changes.
+
 ## Scope
 
 This repository owns optional cryptographic platform capabilities: vaults, key
diff --git a/src/govoplan_encryption/backend/manifest.py b/src/govoplan_encryption/backend/manifest.py
index 18a28cd..8d3ed38 100644
--- a/src/govoplan_encryption/backend/manifest.py
+++ b/src/govoplan_encryption/backend/manifest.py
@@ -7,6 +7,7 @@ from govoplan_core.core.modules import (
     PermissionDefinition,
     RoleTemplate,
 )
+from govoplan_core.core.provider_governance import declared_module_architecture
 
 
 MODULE_ID = "encryption"
@@ -118,12 +119,22 @@ manifest = ModuleManifest(
                 "explicitly exported, or cryptographically deleted."
             ),
             layer="available",
-            documentation_types=("admin",),
-            audience=("administrator", "security_officer", "product_owner"),
+            documentation_types=("admin", "user"),
+            audience=("user", "administrator", "security_officer", "product_owner"),
             related_modules=OPTIONAL_DEPENDENCIES,
             order=100,
         ),
     ),
+    architecture=declared_module_architecture(
+        layer="institutional_foundation",
+        kind="foundation",
+        maturity="scaffold",
+        documentation_ref="docs/ENCRYPTION_BOUNDARY.md",
+        known_limits=("No production key vault, protected-content persistence, rotation worker, or recovery ceremony is implemented yet.",),
+        owned_concepts=("key vault", "content-protection envelope", "cryptographic recovery ceremony"),
+        non_owned_concepts=("domain content", "resource ownership", "account authentication"),
+        security_docs=("docs/ENCRYPTION_BOUNDARY.md",),
+    ),
 )