Restrict rendered template artifacts

docs/ADMIN_GUIDE.md

@@ -24,6 +24,12 @@ template, input, and output hashes. Otherwise Templates stores a bounded
 database payload. Review database and Files retention together before deleting
 render evidence.
 
+Without Files, output payloads are bounded and retained by Templates. Ordinary
+users can list and download only output they rendered themselves; a principal
+with `templates:template:admin` can inspect all tenant render evidence. Consumer
+modules must not redistribute the Templates download URL directly when their
+resource access rules differ.
+
 ## Operations
 
 Apply the module Alembic migration before startup. Monitor rejected renders for

docs/TEMPLATE_BOUNDARY.md

@@ -29,7 +29,7 @@ reference; Templates does not fetch or silently refresh that source.
 Files optionally implements `files.artifact_store`. A final render can request
 managed persistence through that contract. If Files is absent, incompatible,
 or unauthorized, the result carries a warning and remains available through a
-5 MiB bounded Templates download. Managed output is not duplicated in the
+5 MiB actor-scoped Templates download. Managed output is not duplicated in the
 Templates payload column.
 
 ## Safety And Determinism
@@ -50,6 +50,8 @@ Templates payload column.
 
 Template definitions, revisions, render evidence, and bounded output are in the
 shared database and therefore follow platform backup and restore. Managed Files
-artifacts follow Files recovery. Retiring the module is destructive only after
-the installer captures a database snapshot; consumers retain pinned hashes and
-must diagnose the now-unavailable provider.
+artifacts follow Files recovery. Bounded render payloads and history are visible
+only to their creator or a Templates administrator; consumers provide a
+resource-governed proxy when collaborators need access. Retiring the module is
+destructive only after the installer captures a database snapshot; consumers
+retain pinned hashes and must diagnose the now-unavailable provider.

docs/USER_GUIDE.md

@@ -14,6 +14,9 @@ Open **Templates** to create or select a reusable definition.
    mismatches before output is produced.
 6. Preview a draft or render final output. Store it in Files when that module is
    available and you have upload permission; otherwise use the bounded download.
+   Bounded output history is visible only to the actor who rendered it and to a
+   Templates administrator. Calling modules expose their own governed download
+   when additional collaborators need access.
 
 Render evidence shows the exact revision and abbreviated template, input, and
 output hashes. A consumer such as Campaign can submit many frozen recipients;