diff --git a/docs/workflow-model.md b/docs/workflow-model.md
index 15c57ad74..386c7074c 100644
--- a/docs/workflow-model.md
+++ b/docs/workflow-model.md
@@ -49,13 +49,13 @@ storage.
 
 ## Authority boundaries
 
-| Operation                         | Canonical operation                                                                                                                                   | Authorized as                                                                                          | Human approval                                                                                                   |
-| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- |
-| Store source (create / republish) | `@corbits/workflows`'s `./authoring` registry → `AssetService.createAsset` / `populateAsset` (hub-signed commit)                                      | Initiating tenant + principal; `@intx/authz` `authorize` on `asset:*`/`create` or `asset:<id>`/`write` | None (writing source is not a side effect)                                                                       |
-| Deploy source                     | `POST /api/tenants/:tenantId/workflows/deployments` → vendored `SessionService.deployWorkflowFromSource`                                              | Tenant session or run bearer; `workflow:*`/`create`                                                    | Agent-initiated deploys go through an `approval: "ask"` tool call carrying the probed capability surface (below) |
-| Create / update a routine         | `createRoutineRoutes` `POST /routines`, `PATCH /routines/:id`; the run-authenticated mirror `createWorkflowRoutineRoutes` delegates to the same store | Tenant + principal; target validated against the resolution rule above before persisting               | None; a routine only references a definition asset — nothing executes at create/update time                      |
-| Launch                            | `launchAndCorrelate` (`packages/routines/src/routes.ts`) → hub `RoutineLauncher`                                                                      | Routine's tenant; grants materialized by the native launch path                                        | Runtime tool calls with `approval: "ask"` park on the native `approval` resource                                 |
-| Approve                           | Native `POST /api/tenants/:tenantId/approvals/:id/approve`                                                                                            | A principal holding `approval:*`/`resolve` — a human; no agent holds it                                | This is the approval                                                                                             |
+| Operation                         | Canonical operation                                                                                                                                   | Authorized as                                                                                                                                                                                                           | Human approval                                                                                                   |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| Store source (create / republish) | `@corbits/workflows`'s `./authoring` registry → `AssetService.createAsset` / `populateAsset` (hub-signed commit)                                      | Initiating tenant + principal; `@intx/authz` `authorize` on `asset:*`/`create` or `asset:<id>`/`write`                                                                                                                  | None (writing source is not a side effect)                                                                       |
+| Deploy source                     | `POST /api/tenants/:tenantId/workflows/deployments` → vendored `SessionService.deployWorkflowFromSource`                                              | Tenant session or run bearer; `workflow:*`/`create`                                                                                                                                                                     | Agent-initiated deploys go through an `approval: "ask"` tool call carrying the probed capability surface (below) |
+| Create / update a routine         | `createRoutineRoutes` `POST /routines`, `PATCH /routines/:id`; the run-authenticated mirror `createWorkflowRoutineRoutes` delegates to the same store | Tenant + principal; target validated against the resolution rule above before persisting                                                                                                                                | None; a routine only references a definition asset — nothing executes at create/update time                      |
+| Launch                            | `launchAndCorrelate` (`packages/routines/src/routes.ts`) → hub `RoutineLauncher`                                                                      | The workflow run's own principal, granted natively (per-pin tool grants, mail-triggered run grants); no creator re-authorization — the fire's gates are fail-closed target resolution plus native grant materialization | Runtime tool calls with `approval: "ask"` park on the native `approval` resource                                 |
+| Approve                           | Native `POST /api/tenants/:tenantId/approvals/:id/approve`                                                                                            | A principal holding `approval:*`/`resolve` — a human; no agent holds it                                                                                                                                                 | This is the approval                                                                                             |
 
 Credentials and resolved provider secrets never enter source trees, deploy
 requests recorded by `@corbits/workflows`'s `./deploy-source`, or routine rows.