Overview
Host-system end users, provisioned idempotently by external ID within a tenant. Each user holds at most one role and automatically receives an S3-style storage bucket; effective skills derive from the role. Includes user-scoped, write-only secret vaulting.