diff --git a/.env.example b/.env.example
index 6a1a0087..6c28c57d 100644
--- a/.env.example
+++ b/.env.example
@@ -32,6 +32,13 @@ ADMIN_SECRET=12345678
 ATOM_MIN_PASSWORD_CHARS=8
 # ADMIN_ENTITY_ID=00000000-0000-0000-0000-000000000001
 
+# --- Config-file bootstrap ----------------------------------------------
+# Optional. Path to a YAML file describing the RBAC baseline (tenants,
+# entities + credentials, groups, permission blocks, roles, policies) to
+# provision at startup, applied idempotently after migrations. See
+# bootstrap.example.yaml. Leave unset to rely on the env-var bootstrap above.
+# ATOM_BOOTSTRAP_FILE=./bootstrap.yaml
+
 # --- Secret encryption at rest -----------------------------------------
 # Root AES-256-GCM key encrypting every recoverable secret: signing private
 # keys and retrievable credential secrets (shared keys). Required to create
diff --git a/AGENTS.md b/AGENTS.md
index 6db146d6..cda62854 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,8 +17,13 @@ Lightweight replacement for Keycloak — single Rust binary, single Postgres dat
 
 ```
 src/
-  main.rs              — startup: config, DB pool, migrations, admin bootstrap, router
+  main.rs              — startup: config, DB pool, migrations, admin bootstrap,
+  │                       config-file bootstrap, router
   config.rs            — Config struct, reads env vars (incl. ADMIN_ENTITY_ID, ADMIN_SECRET)
+  bootstrap.rs         — optional idempotent YAML bootstrap (ATOM_BOOTSTRAP_FILE):
+  │                       tenants, entities+credentials, resources, principal &
+  │                       object groups, permission blocks, roles, role
+  │                       assignments, direct policies
   state.rs             — AppState (pool + config), cloned into every handler
   routes.rs            — live router: GraphQL, gRPC, auth/session REST, custom endpoints,
   │                       JWKS, health/live, health/ready, cert artifacts (rate-limit + CORS layers)
@@ -206,6 +211,7 @@ Environment variables: copy `.env.example` to `.env`. Required: `DATABASE_URL`.
 
 Optional: `ADMIN_SECRET` — if set, bootstraps the admin entity's password on first boot.
 Optional: `ADMIN_ENTITY_ID` — override the seeded admin UUID (default `00000000-0000-0000-0000-000000000001`).
+Optional: `ATOM_BOOTSTRAP_FILE` — path to a YAML file (`src/bootstrap.rs`) applied idempotently after migrations to provision the RBAC baseline (tenants, entities + credentials, groups, permission blocks, roles, policies); runs alongside the env-var bootstrap. See `bootstrap.example.yaml`.
 
 The runtime is production-hardened: configurable DB pool, five-category IP rate limiter, GraphQL depth/complexity/introspection limits (introspection **off** by default — opt in with `ATOM_GRAPHQL_INTROSPECTION_ENABLED=true`), per-route body limits, encryption at rest for recoverable secrets (signing keys, shared keys), audit retention, a `/health/ready` readiness probe, and graceful shutdown on SIGINT/SIGTERM (both the HTTP and gRPC servers drain in-flight requests before exit).
 
@@ -221,6 +227,56 @@ must then be confined to a private network or a service mesh that provides
 transport security, and a startup warning is logged. (The HTTP rate limiter does
 not cover gRPC; see backlog #10.)
 
+## Callouts (external policy hooks)
+
+Atom can consult an external policy service before executing configured
+GraphQL resolvers or gRPC methods, and refuse the operation on a DENY.
+Pattern is a Rust port of magistrala v0.14's `pkg/callout` + per-domain
+middlewares.
+
+- **Config-driven**, per-operation opt-in. `callouts.yaml` (loaded when
+  `ATOM_CALLOUTS_FILE` is set) lists reusable HTTP or gRPC `endpoints:` and a
+  set of `operations:` that opt in by resolver name (GraphQL) or
+  fully-qualified method (gRPC). Kill-switch: `ATOM_CALLOUTS_ENABLED=false`.
+  Env overrides per endpoint id: `ATOM_CALLOUT_<UPPER_ID>_URL`, `_ADDRESS`,
+  `_TIMEOUT_MS`. See `callouts.example.yaml`.
+- **Two transports, one wire shape.** HTTP (POST/GET, TLS + mTLS via reqwest)
+  and gRPC (tonic client of `atom.v1.callout.Callout/Check` — see
+  `proto/atom/v1/callout.proto`). Both send the same canonical envelope
+  (operation, surface, request_id, time, actor, args, extra); GET flattens
+  it to a query string for magistrala v0.14 parity.
+- **Field selection.** Each operation entry has an `include:` list of
+  dot-paths (`actor.entity_id`, `args.input.name`) — a whitelist. `extra:` is
+  a static payload merged in from config. Independent of `include:`, a hard
+  denylist strips keys named `secret`, `password`, or `key` at any depth as
+  a safety net.
+- **Chain semantics.** Multiple endpoints per operation run **sequentially,
+  fail-fast** — all must ALLOW for the operation to proceed. First non-ALLOW
+  short-circuits with the endpoint's reason. Transport error / timeout
+  applies the per-endpoint `on_error:` policy (default `deny` — matches
+  atom's default-deny invariant).
+- **Where it runs in the request pipeline.** For both surfaces:
+  authn → **callout** → scope gates (`RequireManage` / `require_any_capability`) →
+  PDP → repo mutation. The extension owns the "before" hook only; overrides
+  and post-hooks are deliberately out of scope for v1 (post-execution
+  notifications remain the AMQP event outbox's job).
+- **GraphQL wiring**: `graphql::callout_ext::CalloutExtensionFactory`
+  registered on the schema builder. `parse_query` walks the parsed document,
+  resolves variables, and records one pending callout per top-level field
+  that has a matching entry in `CalloutService`. `execute` runs the chain
+  and returns `Response::from_errors(...)` on the first DENY. Adding a new
+  GraphQL op to callouts is config-only.
+- **gRPC wiring**: each of the ~6 gRPC methods calls a shared
+  `callout_check_grpc(...)` helper in `src/grpc.rs`, keyed by a `const`
+  operation name (`callout_ops::*`). Adding a *new* gRPC method to callouts
+  is config + one line here — deliberate, since the gRPC surface is small
+  and generic prost reflection wasn't worth the complexity.
+- **Metrics + audit.** `atom_callout_calls_total{operation, endpoint,
+  transport, result}` and `atom_callout_call_duration_seconds` through the
+  metrics façade. Every DENY writes an `audit_logs` row
+  (`event="callout.deny"`, target_kind="callout", details include operation
+  + endpoint id + reason) fire-and-forget through `audit::write`.
+
 ## Metrics
 
 Prometheus metrics are exposed at `GET /metrics` (text exposition). All metric
diff --git a/Cargo.lock b/Cargo.lock
index d22a1a45..44992200 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -423,6 +423,8 @@ dependencies = [
  "argon2",
  "async-graphql",
  "async-graphql-axum",
+ "async-graphql-value",
+ "async-trait",
  "axum",
  "base64 0.22.1",
  "chrono",
@@ -441,11 +443,14 @@ dependencies = [
  "openidconnect",
  "p256",
  "prost",
+ "prost-types",
  "rand 0.8.6",
  "rcgen",
+ "reqwest",
  "ring",
  "serde",
  "serde_json",
+ "serde_yaml",
  "sqlx",
  "thiserror 1.0.69",
  "time",
@@ -3758,6 +3763,19 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap 2.14.0",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -4753,6 +4771,12 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
 [[package]]
 name = "untrusted"
 version = "0.7.1"
diff --git a/Cargo.toml b/Cargo.toml
index f3115ba5..e5be7d46 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,11 +12,14 @@ path = "src/main.rs"
 [dependencies]
 axum = { version = "0.7", features = ["json", "macros"] }
 async-graphql = { version = "=7.2.1", default-features = false }
+async-graphql-value = "=7.2.1"
 async-graphql-axum = "=7.0.13"
+async-trait = "0.1"
 tokio = { version = "1", features = ["full"] }
 sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "json", "migrate", "macros", "derive"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde_yaml = "0.9"
 jsonschema = { version = "0.18", default-features = false }
 uuid = { version = "1", features = ["serde", "v4"] }
 chrono = { version = "0.4", features = ["serde"] }
@@ -38,6 +41,7 @@ base64 = "0.22"
 tonic = { version = "0.12", features = ["tls"] }
 tonic-health = "0.12"
 prost = "0.13"
+prost-types = "0.13"
 lettre = { version = "0.11.21", default-features = false, features = ["builder", "smtp-transport", "tokio1-rustls-tls"] }
 minijinja = { version = "2", default-features = false, features = ["serde"] }
 url = "2"
@@ -54,6 +58,10 @@ lapin = { version = "4.10.0", default-features = false, features = [
     "rustls--ring",
     "rustls-webpki-roots-certs",
 ] }
+# Used by src/callout/http.rs for calling out to external policy services.
+# rustls (not native-tls) so the deployment does not need OpenSSL at build/run
+# time; matches lapin's TLS backend.
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 
 [features]
 # Metrics are on by default. Disable at compile time for maximum-performance
diff --git a/README.md b/README.md
index a7fbc15a..5af6a9da 100644
--- a/README.md
+++ b/README.md
@@ -659,6 +659,7 @@ Generic application mapping:
 | `ADMIN_SECRET`                                                                                                                 | *(optional)*                                         | Seeds the admin password on first boot                                                  |
 | `ADMIN_ENTITY_ID`                                                                                                              | `00000000-0000-0000-0000-000000000001`               | Override seeded admin UUID                                                              |
 | `ATOM_SERVICE_SECRET` / `ATOM_SERVICE_ENTITY_ID`                                                                               | *(optional)* / seeded service UUID                   | Seeds a service entity password on first boot                                           |
+| `ATOM_BOOTSTRAP_FILE`                                                                                                          | *(optional)*                                         | Path to a YAML file provisioning the RBAC baseline at startup (idempotent)              |
 | `ATOM_MIN_PASSWORD_CHARS`                                                                                                      | `12`                                                 | Minimum password length                                                                 |
 | `ATOM_CORS_ALLOWED_ORIGINS`                                                                                                    | `ATOM_PUBLIC_BASE_URL`                               | Comma-separated allowed CORS origins                                                    |
 | `ATOM_AUTH_COOKIE_SECURE` / `ATOM_AUTH_COOKIE_DOMAIN`                                                                          | auto-detect HTTPS / *(unset)*                        | Auth cookie options for UI flows                                                        |
@@ -777,6 +778,88 @@ ingress that overwrites client IP headers. If the Atom UI is also proxying
 requests to Atom, enable `ATOM_UI_FORWARD_CLIENT_IP_HEADERS=true` only behind an
 upstream proxy that sanitizes those headers.
 
+### Bootstrapping with a config file
+
+Standing up a fresh deployment no longer requires driving the API by hand or
+juggling one `*_SECRET` env var per identity. Point Atom at a YAML file and it
+provisions the whole RBAC baseline — tenants, entities and their credentials,
+resources, principal groups, object groups, permission blocks, roles and
+policies — at startup:
+
+```bash
+ATOM_BOOTSTRAP_FILE=./bootstrap.yaml
+```
+
+```yaml
+# bootstrap.yaml
+tenants:
+  - id: 33333333-3333-3333-3333-333333333333
+    name: factory
+    alias: factory
+
+entities:
+  # Attach a password to the pre-seeded admin (replaces ADMIN_SECRET).
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    credentials:
+      - kind: password
+        secret: change-me-please
+  # A device inside the factory tenant with a machine shared key.
+  - id: 22222222-2222-2222-2222-222222222222
+    kind: device
+    name: gateway-01
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    credentials:
+      - kind: shared_key
+        key: replace-with-a-strong-machine-secret
+
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope: { mode: object_type, tenant_id: 33333333-3333-3333-3333-333333333333, object_kind: resource, object_type: resource:channel }
+    actions: [publish, subscribe]
+    effect: allow
+
+roles:
+  - id: 55555555-5555-5555-5555-555555555555
+    name: publisher
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    permission_blocks: [44444444-4444-4444-4444-444444444444]
+
+role_assignments:
+  - id: 66666666-6666-6666-6666-666666666666
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    subject: { kind: entity, id: 22222222-2222-2222-2222-222222222222 }
+    role_id: 55555555-5555-5555-5555-555555555555
+```
+
+Sections are applied in dependency order: `tenants` → `entities` (+
+credentials) → `resources` → `groups` (+ members) → `object_groups` (+ members,
+hierarchy) → `permission_blocks` (+ actions) → `roles` (+ block links) →
+`role_assignments` → `direct_policies`. Every section is optional, and records
+may reference rows that already exist in the database (for example the
+pre-seeded `admin` entity or `atom-admin` role).
+
+The file is applied once, right after migrations, and is **idempotent**: every
+record is keyed on a stable UUID and inserted with `ON CONFLICT DO NOTHING`
+(credentials are created only when the entity has no active credential of that
+kind), so re-running against an already-provisioned database is a no-op and
+never clobbers runtime changes. It runs alongside the env-var bootstrap above,
+not instead of it.
+
+Notes: permission-block `scope.mode` is one of `platform`, `tenant`,
+`object_kind`, `object_type`, `object`, or a group-relative mode
+(`group_direct_objects`, `group_descendant_objects`, `group_child_groups`,
+`group_descendant_groups`) which scopes to an object group via `scope.group_id`
+— the `*_objects` modes also take `object_kind` (`entity`/`resource`) and
+`object_type` (e.g. `resource:channel`); block `actions` are seeded action
+names. An entity or resource belongs to at most one object group, and an object
+group with members must declare `tenant_id`. `shared_key` credentials are only valid for
+machine (non-human) entities and require an explicit `key`. Secrets are written
+in plaintext just like `ADMIN_SECRET`, so treat the file as a secret (restrict
+its mode, keep it out of version control). See
+[`bootstrap.example.yaml`](bootstrap.example.yaml) for a fuller example.
+
 ---
 
 ## Authentication
diff --git a/app/components/crud/crud-table.tsx b/app/components/crud/crud-table.tsx
index 4ab4814d..66844158 100644
--- a/app/components/crud/crud-table.tsx
+++ b/app/components/crud/crud-table.tsx
@@ -28,6 +28,7 @@ import { CrudInspectSheet } from "@/components/crud/table/inspect-sheet";
 import type { CrudTableProps, Row } from "@/components/crud/table/types";
 import {
   defer,
+  isConfigManagedRow,
   isDeletedRow,
   singularize,
   tenantActionPastTense,
@@ -438,6 +439,21 @@ function TableRowActions({
   row: Row;
   tenantStatusPending: boolean;
 }) {
+  // Rows carrying `managed_by='config'` in the database were provisioned
+  // from the Atom bootstrap YAML. The API rejects update/delete/restore on
+  // them with 409 conflict, so hide the mutation buttons and offer only
+  // Inspect — mirrors the isDeletedRow pattern below. See
+  // components/crud/managed-by-badge.tsx.
+  if (isConfigManagedRow(row)) {
+    return (
+      <div className="flex justify-end gap-2">
+        <Button onClick={onInspect} size="sm" variant="outline">
+          Inspect
+        </Button>
+      </div>
+    );
+  }
+
   if (isDeletedRow(row)) {
     return (
       <div className="flex justify-end gap-2">
diff --git a/app/components/crud/managed-by-badge.tsx b/app/components/crud/managed-by-badge.tsx
new file mode 100644
index 00000000..7c5429c5
--- /dev/null
+++ b/app/components/crud/managed-by-badge.tsx
@@ -0,0 +1,41 @@
+import { Lock } from "lucide-react";
+
+import { cn } from "@/lib/utils";
+
+/**
+ * Renders "Config" when a row was provisioned from the Atom bootstrap YAML.
+ * Rows carrying `managed_by='config'` are read-only through the API —
+ * update/delete/revoke calls return 409 conflict — so the UI surfaces this
+ * marker and disables their mutation buttons.
+ */
+export function ManagedByBadge({
+  managedBy,
+  className,
+}: {
+  managedBy?: string | null;
+  className?: string;
+}) {
+  if (managedBy !== "config") return null;
+  return (
+    <span
+      className={cn(
+        "inline-flex h-5 w-fit shrink-0 items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap",
+        "border-slate-500/40 bg-slate-500/10 text-slate-700 dark:border-slate-400/40 dark:text-slate-300",
+        className,
+      )}
+      title="Managed by the bootstrap config file — read-only through the API"
+    >
+      <Lock className="h-3 w-3" aria-hidden />
+      Config
+    </span>
+  );
+}
+
+/** Row-shape predicate: true when the row must be shown read-only in the UI. */
+export function isConfigManaged(row: { managedBy?: string | null }): boolean {
+  return row.managedBy === "config";
+}
+
+/** Tooltip text for a disabled button on a config-managed row. */
+export const CONFIG_MANAGED_TOOLTIP =
+  "Managed by the bootstrap config file. Edit the YAML and restart Atom to change.";
diff --git a/app/components/crud/table/cell-rendering.tsx b/app/components/crud/table/cell-rendering.tsx
index a995b184..8caeda39 100644
--- a/app/components/crud/table/cell-rendering.tsx
+++ b/app/components/crud/table/cell-rendering.tsx
@@ -1,3 +1,4 @@
+import { ManagedByBadge } from "@/components/crud/managed-by-badge";
 import { StatusBadge } from "@/components/crud/status-badge";
 import { DisplayTimeCell } from "@/components/display-time";
 import { DisplayTags } from "@/components/view-tags";
@@ -17,6 +18,9 @@ export function renderCell(
   key?: string,
   nameMap?: Map<string, string>,
 ) {
+  if (key === "managedBy") {
+    return <ManagedByBadge managedBy={value as string | null | undefined} />;
+  }
   if (value === null || value === undefined || value === "") {
     return <span className="text-muted-foreground">-</span>;
   }
diff --git a/app/components/crud/table/utils.ts b/app/components/crud/table/utils.ts
index af795aa5..15bbe4ba 100644
--- a/app/components/crud/table/utils.ts
+++ b/app/components/crud/table/utils.ts
@@ -5,6 +5,16 @@ export function isDeletedRow(row: Row) {
   return Boolean(row.deletedAt) || String(row.status ?? "") === "deleted";
 }
 
+/**
+ * A row is "config-managed" when it was provisioned from the Atom bootstrap
+ * YAML file. The API rejects update/delete/restore on these rows with 409
+ * conflict, so the UI hides mutation buttons — see
+ * `components/crud/managed-by-badge.tsx` for the shared badge.
+ */
+export function isConfigManagedRow(row: Row) {
+  return String(row.managedBy ?? "") === "config";
+}
+
 export function tenantActionPastTense(
   action: keyof typeof TENANT_STATUS_MUTATIONS,
 ) {
diff --git a/app/components/entities/entity-credentials.tsx b/app/components/entities/entity-credentials.tsx
index eb8aff17..7581fb65 100644
--- a/app/components/entities/entity-credentials.tsx
+++ b/app/components/entities/entity-credentials.tsx
@@ -13,6 +13,7 @@ import {
 } from "lucide-react";
 import * as React from "react";
 import { toast } from "sonner";
+import { ManagedByBadge } from "@/components/crud/managed-by-badge";
 import { StatusBadge } from "@/components/crud/status-badge";
 import { DisplayTimeCell } from "@/components/display-time";
 import { Badge } from "@/components/ui/badge";
@@ -34,6 +35,7 @@ const CREDENTIALS_QUERY = `
         identifier
         expiresAt
         createdAt
+        managedBy
       }
       total
     }
@@ -63,6 +65,7 @@ const ENTITY_ACCESS_TOKENS_QUERY = `
         credentialId
         name
         scoped
+        managedBy
         permissions {
           actions
           scopeMode
@@ -177,6 +180,7 @@ type Credential = {
   identifier: string | null;
   expiresAt: string | null;
   createdAt: string;
+  managedBy: string | null;
 };
 
 type CredentialKind = "password" | "api_key" | "shared_key" | "certificate";
@@ -194,6 +198,7 @@ type EntityAccessToken = {
   credentialId: string;
   name: string;
   scoped: boolean;
+  managedBy: string | null;
   permissions: TokenPermission[];
   lastUsedAt: string | null;
 };
@@ -958,6 +963,11 @@ function CredentialRow({
   downloading: boolean;
   revealing: boolean;
 }) {
+  // Config-managed credentials are provisioned from the bootstrap YAML; the
+  // API refuses revoke/reveal/replace with 409 (or, for reveal, not_found),
+  // so hide the action buttons entirely and surface the badge instead.
+  const configManaged =
+    cred.managedBy === "config" || token?.managedBy === "config";
   return (
     <div className="flex items-start justify-between gap-3 rounded-lg border bg-background p-3">
       <div className="flex min-w-0 items-start gap-2">
@@ -969,6 +979,7 @@ function CredentialRow({
             </span>
             <StatusBadge value={cred.status} />
             {token?.scoped ? <Badge variant="outline">scoped</Badge> : null}
+            <ManagedByBadge managedBy={cred.managedBy ?? token?.managedBy} />
           </div>
           {cred.identifier ? (
             <div className="font-mono text-xs text-muted-foreground truncate">
@@ -1015,7 +1026,7 @@ function CredentialRow({
           </div>
         </div>
       </div>
-      {cred.status === "active" ? (
+      {cred.status === "active" && !configManaged ? (
         <div className="flex shrink-0 gap-1">
           {onDownload ? (
             <Button
diff --git a/app/lib/crud/resources.ts b/app/lib/crud/resources.ts
index 5394cf76..e594364b 100644
--- a/app/lib/crud/resources.ts
+++ b/app/lib/crud/resources.ts
@@ -101,7 +101,7 @@ export const crudResources: CrudResource[] = [
       "Top-level boundaries for entities, resources, groups, roles, and assignments.",
     icon: Building2,
     queryName: "tenants",
-    listQuery: `query Tenants($deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { tenants(deleted: $deleted, limit: $limit, offset: $offset) { total items { id name alias tags attributes status deletedAt deletedBy createdAt updatedAt } } }`,
+    listQuery: `query Tenants($deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { tenants(deleted: $deleted, limit: $limit, offset: $offset) { total items { id name alias tags attributes status deletedAt deletedBy createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreateTenant($input: CreateTenantInput!) { createTenant(input: $input) { id name alias tags status createdAt updatedAt } }`,
     deleteMutation: `mutation DeleteTenant($id: ID!) { deleteTenant(id: $id) }`,
     restoreMutation: `mutation RestoreTenant($id: ID!) { restoreTenant(id: $id) { id } }`,
@@ -114,6 +114,7 @@ export const crudResources: CrudResource[] = [
       { key: "alias", label: "Alias", priority: "medium" },
       { key: "tags", label: "Tags", priority: "medium" },
       { key: "status", label: "Status", priority: "high" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "deletedAt", label: "Deleted at", priority: "low" },
       { key: "deletedBy", label: "Deleted by", priority: "low" },
       { key: "createdAt", label: "Created", priority: "low" },
@@ -133,7 +134,7 @@ export const crudResources: CrudResource[] = [
     icon: Fingerprint,
     queryName: "entities",
     tenantFilter: true,
-    listQuery: `query Entities($tenantId: ID, $kind: EntityKind, $status: EntityStatus, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { entities(tenantId: $tenantId, kind: $kind, status: $status, deleted: $deleted, limit: $limit, offset: $offset) { total items { id kind profileId profileVersionId name alias tenantId parentGroupId attributes status deletedAt deletedBy createdAt updatedAt } } }`,
+    listQuery: `query Entities($tenantId: ID, $kind: EntityKind, $status: EntityStatus, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { entities(tenantId: $tenantId, kind: $kind, status: $status, deleted: $deleted, limit: $limit, offset: $offset) { total items { id kind profileId profileVersionId name alias tenantId parentGroupId attributes status deletedAt deletedBy createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreateEntity($input: CreateEntityInput!) { createEntity(input: $input) { id kind profileId profileVersionId name alias tenantId status createdAt updatedAt } }`,
     deleteMutation: `mutation DeleteEntity($id: ID!) { deleteEntity(id: $id) }`,
     restoreMutation: `mutation RestoreEntity($id: ID!) { restoreEntity(id: $id) }`,
@@ -167,6 +168,7 @@ export const crudResources: CrudResource[] = [
       { key: "kind", label: "Kind", priority: "high" },
       { key: "profileId", label: "Profile", priority: "medium" },
       { key: "status", label: "Status", priority: "high" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "tenantId", label: "Tenant", priority: "medium" },
       { key: "deletedAt", label: "Deleted at", priority: "low" },
       { key: "deletedBy", label: "Deleted by", priority: "low" },
@@ -224,7 +226,7 @@ export const crudResources: CrudResource[] = [
     icon: Users,
     queryName: "groups",
     tenantFilter: true,
-    listQuery: `query Groups($tenantId: ID, $status: EntityStatus, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { groups(tenantId: $tenantId, status: $status, deleted: $deleted, limit: $limit, offset: $offset) { total items { id name tenantId groupType parentId description status deletedAt deletedBy createdAt updatedAt } } }`,
+    listQuery: `query Groups($tenantId: ID, $status: EntityStatus, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { groups(tenantId: $tenantId, status: $status, deleted: $deleted, limit: $limit, offset: $offset) { total items { id name tenantId groupType parentId description status deletedAt deletedBy createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreateGroup($input: CreateGroupInput!) { createGroup(input: $input) { id name tenantId groupType description createdAt updatedAt } }`,
     deleteMutation: `mutation DeleteGroup($id: ID!) { deleteGroup(id: $id) }`,
     restoreMutation: `mutation RestoreGroup($id: ID!) { restoreGroup(id: $id) }`,
@@ -237,6 +239,7 @@ export const crudResources: CrudResource[] = [
       { key: "tenantId", label: "Tenant", priority: "medium" },
       { key: "parentId", label: "Parent", priority: "medium" },
       { key: "description", label: "Description", priority: "low" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "deletedAt", label: "Deleted at", priority: "low" },
       { key: "deletedBy", label: "Deleted by", priority: "low" },
       { key: "createdAt", label: "Created", priority: "low" },
@@ -260,7 +263,7 @@ export const crudResources: CrudResource[] = [
     icon: Server,
     queryName: "resources",
     tenantFilter: true,
-    listQuery: `query Resources($tenantId: ID, $kind: String, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { resources(tenantId: $tenantId, kind: $kind, deleted: $deleted, limit: $limit, offset: $offset) { total items { id kind name alias tenantId ownerId parentGroupId attributes deletedAt deletedBy createdAt updatedAt } } }`,
+    listQuery: `query Resources($tenantId: ID, $kind: String, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { resources(tenantId: $tenantId, kind: $kind, deleted: $deleted, limit: $limit, offset: $offset) { total items { id kind name alias tenantId ownerId parentGroupId attributes deletedAt deletedBy createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreateResource($input: CreateResourceInput!) { createResource(input: $input) { id kind name alias tenantId ownerId createdAt updatedAt } }`,
     deleteMutation: `mutation DeleteResource($id: ID!) { deleteResource(id: $id) }`,
     restoreMutation: `mutation RestoreResource($id: ID!) { restoreResource(id: $id) }`,
@@ -287,6 +290,7 @@ export const crudResources: CrudResource[] = [
       { key: "kind", label: "Kind", priority: "high" },
       { key: "tenantId", label: "Tenant", priority: "medium" },
       { key: "ownerId", label: "Owner", priority: "low" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "deletedAt", label: "Deleted at", priority: "low" },
       { key: "deletedBy", label: "Deleted by", priority: "low" },
       { key: "createdAt", label: "Created", priority: "low" },
@@ -311,7 +315,7 @@ export const crudResources: CrudResource[] = [
     icon: ShieldCheck,
     queryName: "roles",
     tenantFilter: true,
-    listQuery: `query Roles($tenantId: ID, $derivedKind: String, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { roles(tenantId: $tenantId, derivedKind: $derivedKind, deleted: $deleted, limit: $limit, offset: $offset) { total items { id name tenantId description derivedKind deletedAt deletedBy createdAt updatedAt } } }`,
+    listQuery: `query Roles($tenantId: ID, $derivedKind: String, $deleted: DeletedFilter, $limit: Int = 50, $offset: Int = 0) { roles(tenantId: $tenantId, derivedKind: $derivedKind, deleted: $deleted, limit: $limit, offset: $offset) { total items { id name tenantId description derivedKind deletedAt deletedBy createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreateRole($input: CreateRoleInput!) { createRole(input: $input) { id name tenantId description derivedKind createdAt updatedAt } }`,
     deleteMutation: `mutation DeleteRole($id: ID!) { deleteRole(id: $id) }`,
     restoreMutation: `mutation RestoreRole($id: ID!) { restoreRole(id: $id) }`,
@@ -337,6 +341,7 @@ export const crudResources: CrudResource[] = [
       { key: "name", label: "Name", priority: "high" },
       { key: "description", label: "Description", priority: "low" },
       { key: "derivedKind", label: "Kind", priority: "high" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "deletedAt", label: "Deleted at", priority: "low" },
       { key: "deletedBy", label: "Deleted by", priority: "low" },
       { key: "createdAt", label: "Created", priority: "low" },
@@ -361,7 +366,7 @@ export const crudResources: CrudResource[] = [
     icon: Boxes,
     queryName: "permissionBlocks",
     tenantFilter: true,
-    listQuery: `query PermissionBlocks($tenantId: ID, $limit: Int = 50, $offset: Int = 0) { permissionBlocks(tenantId: $tenantId, limit: $limit, offset: $offset) { total items { id tenantId scopeMode objectKind objectType objectId groupId effect conditions actions { id name } createdAt updatedAt } } }`,
+    listQuery: `query PermissionBlocks($tenantId: ID, $limit: Int = 50, $offset: Int = 0) { permissionBlocks(tenantId: $tenantId, limit: $limit, offset: $offset) { total items { id tenantId scopeMode objectKind objectType objectId groupId effect conditions actions { id name } createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreatePermissionBlock($input: CreatePermissionBlockInput!) { createPermissionBlock(input: $input) { id tenantId scopeMode objectKind objectType objectId groupId effect createdAt updatedAt } }`,
     deleteMutation: `mutation DeletePermissionBlock($id: ID!) { deletePermissionBlock(id: $id) }`,
     deleteIdField: "id",
@@ -374,6 +379,7 @@ export const crudResources: CrudResource[] = [
       { key: "groupId", label: "Group", priority: "low" },
       { key: "effect", label: "Effect", priority: "high" },
       { key: "actions", label: "Actions", priority: "high" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "createdAt", label: "Created", priority: "low" },
       { key: "updatedAt", label: "Updated", priority: "low" },
     ],
@@ -401,13 +407,14 @@ export const crudResources: CrudResource[] = [
       "Rows from actions: one unique operation name such as read, write, publish, or execute.",
     icon: KeyRound,
     queryName: "actions",
-    listQuery: `query Actions($limit: Int = 50, $offset: Int = 0) { actions(limit: $limit, offset: $offset) { total items { id name description createdAt updatedAt } } }`,
+    listQuery: `query Actions($limit: Int = 50, $offset: Int = 0) { actions(limit: $limit, offset: $offset) { total items { id name description createdAt updatedAt managedBy } } }`,
     createMutation: `mutation CreateAction($input: CreateActionInput!) { createAction(input: $input) { id name description createdAt updatedAt } }`,
     deleteMutation: `mutation DeleteAction($id: ID!) { deleteAction(id: $id) }`,
     deleteIdField: "id",
     columns: [
       { key: "name", label: "Name", priority: "high" },
       { key: "description", label: "Description", priority: "low" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "createdAt", label: "Created", priority: "low" },
       { key: "updatedAt", label: "Updated", priority: "low" },
     ],
@@ -430,7 +437,7 @@ export const crudResources: CrudResource[] = [
       "Rows from action_applicability: each action/object-kind/object-type pair stored in Atom.",
     icon: KeyRound,
     queryName: "actionApplicability",
-    listQuery: `query ActionApplicability($actionName: String, $objectKind: String, $objectType: String, $limit: Int = 50, $offset: Int = 0) { actionApplicability(actionName: $actionName, objectKind: $objectKind, objectType: $objectType, limit: $limit, offset: $offset) { total items { id actionId actionName objectKind objectType description createdAt } } }`,
+    listQuery: `query ActionApplicability($actionName: String, $objectKind: String, $objectType: String, $limit: Int = 50, $offset: Int = 0) { actionApplicability(actionName: $actionName, objectKind: $objectKind, objectType: $objectType, limit: $limit, offset: $offset) { total items { id actionId actionName objectKind objectType description createdAt managedBy } } }`,
     createMutation: `mutation AddActionApplicability($input: AddActionApplicabilityInput!) { addActionApplicability(input: $input) { id actionId actionName objectKind objectType createdAt } }`,
     deleteMutation: `mutation RemoveActionApplicability($input: RemoveActionApplicabilityInput!) { removeActionApplicability(input: $input) }`,
     filters: [
@@ -481,6 +488,7 @@ export const crudResources: CrudResource[] = [
       { key: "objectKind", label: "Object kind", priority: "high" },
       { key: "objectType", label: "Object type", priority: "high" },
       { key: "description", label: "Description", priority: "low" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "createdAt", label: "Created", priority: "low" },
     ],
     sampleRows: [
@@ -507,7 +515,7 @@ export const crudResources: CrudResource[] = [
     icon: SlidersHorizontal,
     queryName: "actionAssignmentRules",
     tenantFilter: true,
-    listQuery: `query ActionAssignmentRules($tenantId: ID, $entityKind: EntityKind, $actionName: String, $objectKind: String, $decision: ActionAssignmentRuleDecision, $limit: Int = 50, $offset: Int = 0) { actionAssignmentRules(tenantId: $tenantId, entityKind: $entityKind, actionName: $actionName, objectKind: $objectKind, decision: $decision, limit: $limit, offset: $offset) { total items { id tenantId entityKind actionName objectKind objectType decision isAbsolute createdAt } } }`,
+    listQuery: `query ActionAssignmentRules($tenantId: ID, $entityKind: EntityKind, $actionName: String, $objectKind: String, $decision: ActionAssignmentRuleDecision, $limit: Int = 50, $offset: Int = 0) { actionAssignmentRules(tenantId: $tenantId, entityKind: $entityKind, actionName: $actionName, objectKind: $objectKind, decision: $decision, limit: $limit, offset: $offset) { total items { id tenantId entityKind actionName objectKind objectType decision isAbsolute createdAt managedBy } } }`,
     deleteMutation: `mutation DeleteActionAssignmentRule($id: ID!) { deleteActionAssignmentRule(id: $id) }`,
     deleteIdField: "id",
     filters: [
@@ -568,6 +576,7 @@ export const crudResources: CrudResource[] = [
       { key: "objectType", label: "Object type", priority: "medium" },
       { key: "decision", label: "Decision", priority: "high" },
       { key: "isAbsolute", label: "Absolute", priority: "medium" },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "createdAt", label: "Created", priority: "low" },
     ],
     sampleRows: [
@@ -594,7 +603,7 @@ export const crudResources: CrudResource[] = [
       "Advanced subject-to-permission-block grants. Normal access should prefer role assignments.",
     icon: GitBranch,
     queryName: "directPolicies",
-    listQuery: `query DirectPolicies($tenantId: ID, $limit: Int = 50, $offset: Int = 0) { directPolicies(tenantId: $tenantId, limit: $limit, offset: $offset) { total items { id tenantId subjectKind subjectId permissionBlockId createdAt } } }`,
+    listQuery: `query DirectPolicies($tenantId: ID, $limit: Int = 50, $offset: Int = 0) { directPolicies(tenantId: $tenantId, limit: $limit, offset: $offset) { total items { id tenantId subjectKind subjectId permissionBlockId createdAt managedBy } } }`,
     createMutation: `mutation CreateDirectPolicy($input: CreateDirectPolicyInput!) { createDirectPolicy(input: $input) { id tenantId subjectKind subjectId permissionBlockId createdAt } }`,
     deleteMutation: `mutation DeleteDirectPolicy($id: ID!) { deleteDirectPolicy(id: $id) }`,
     deleteIdField: "id",
@@ -608,6 +617,7 @@ export const crudResources: CrudResource[] = [
         label: "Permission block",
         priority: "high",
       },
+      { key: "managedBy", label: "Managed", priority: "medium" },
       { key: "createdAt", label: "Created", priority: "low" },
     ],
     sampleRows: [
diff --git a/bootstrap.example.yaml b/bootstrap.example.yaml
new file mode 100644
index 00000000..5c35f73b
--- /dev/null
+++ b/bootstrap.example.yaml
@@ -0,0 +1,129 @@
+# Atom bootstrap file (example).
+#
+# Point Atom at this file with ATOM_BOOTSTRAP_FILE=/path/to/bootstrap.yaml.
+# It is applied once at startup, right after migrations, and is idempotent:
+# every record is keyed on a stable UUID and inserted with ON CONFLICT DO
+# NOTHING, so existing rows are left untouched and it is safe to leave
+# configured across restarts. Records may reference rows that already exist in
+# the database (e.g. the pre-seeded `admin` entity or `atom-admin` role).
+#
+# Sections are applied in dependency order:
+#   tenants -> entities (+credentials) -> resources -> groups (+members)
+#     -> object_groups (+members, hierarchy) -> permission_blocks (+actions)
+#     -> roles (+block links) -> role_assignments -> direct_policies
+#
+# Secrets are declared inline (just like ADMIN_SECRET) — protect this file:
+# mount it as a secret, keep it out of version control, restrict its mode.
+
+# --- Tenants (domains) ---------------------------------------------------
+tenants:
+  - id: 33333333-3333-3333-3333-333333333333
+    name: factory
+    alias: factory
+    tags: [demo, factory]
+    attributes:
+      region: eu
+      plan: gold
+    # status: active   # active | inactive | frozen (default active)
+
+# --- Entities (+ credentials) --------------------------------------------
+entities:
+  # Attach a password to the pre-seeded platform admin (replaces ADMIN_SECRET).
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    credentials:
+      - kind: password
+        secret: change-me-please
+
+  # A device placed inside the factory tenant, with a machine shared key.
+  - id: 22222222-2222-2222-2222-222222222222
+    kind: device
+    name: gateway-01
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    credentials:
+      - kind: shared_key
+        key: replace-with-a-strong-device-secret
+
+# --- Resources (protected objects, e.g. channels) ------------------------
+resources:
+  - id: 99999999-9999-9999-9999-999999999999
+    kind: channel
+    name: temperature
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    owner_id: 22222222-2222-2222-2222-222222222222
+    attributes:
+      topic: temperature
+
+# --- Principal (subject) groups (+ members) ------------------------------
+groups:
+  - id: 77777777-7777-7777-7777-777777777777
+    name: publishers
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    description: Devices allowed to publish telemetry
+    members:
+      - 22222222-2222-2222-2222-222222222222
+
+# --- Object groups (group entities/resources for group-scoped blocks) ----
+# An entity or resource belongs to at most one object group. A group with
+# members must declare tenant_id. `parent` nests groups for descendant scopes.
+object_groups:
+  - id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+    name: production-channels
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    resources:
+      - 99999999-9999-9999-9999-999999999999
+
+# --- Permission blocks (scope + actions + effect + conditions) -----------
+# Shared: link to roles below and/or grant directly via direct_policies.
+# scope.mode: platform | tenant | object_kind | object_type | object
+#   | group_direct_objects | group_descendant_objects
+#   | group_child_groups | group_descendant_groups
+# The group_* modes require scope.group_id (an object group). The
+# group_*_objects modes also take object_kind (entity|resource) and object_type.
+permission_blocks:
+  # Type-scoped: any channel resource in the tenant.
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: object_type
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      object_kind: resource
+      object_type: resource:channel
+    actions: [publish, subscribe]
+    effect: allow
+    # conditions: {}   # flat ABAC object, ANDed; defaults to {} (always matches)
+
+  # Group-scoped: only the channel resource members of an object group.
+  - id: bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
+    scope:
+      mode: group_direct_objects
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      group_id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+      object_kind: resource
+      object_type: resource:channel
+    actions: [read]
+    effect: allow
+
+# --- Roles (named collections of permission blocks) ----------------------
+roles:
+  - id: 55555555-5555-5555-5555-555555555555
+    name: publisher
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    description: Devices that can publish telemetry
+    permission_blocks:
+      - 44444444-4444-4444-4444-444444444444
+      - bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
+
+# --- Role assignments (subject gets a role) ------------------------------
+role_assignments:
+  - id: 66666666-6666-6666-6666-666666666666
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    subject: { kind: entity, id: 22222222-2222-2222-2222-222222222222 }
+    role_id: 55555555-5555-5555-5555-555555555555
+
+# --- Direct policies (subject gets one permission block directly) --------
+direct_policies:
+  - id: 88888888-8888-8888-8888-888888888888
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    subject: { kind: group, id: 77777777-7777-7777-7777-777777777777 }
+    permission_block_id: 44444444-4444-4444-4444-444444444444
diff --git a/build.rs b/build.rs
index b2a2ce5f..d3e420c3 100644
--- a/build.rs
+++ b/build.rs
@@ -8,6 +8,13 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     println!("cargo:rustc-env=ATOM_REVISION={revision}");
 
     tonic_build::compile_protos("proto/atom/v1/atom.proto")?;
+    // Callout service — atom is the *client* here (talks out to an external
+    // policy service), but tonic-build generates the client and server sides
+    // together and only the client is wired into main. Uses well-known Struct
+    // for the free-form args/extra payload.
+    // Client + server: server is unused in production (atom is only ever the
+    // client here), but tests implement a mock server against this proto.
+    tonic_build::configure().compile_protos(&["proto/atom/v1/callout.proto"], &["proto"])?;
     Ok(())
 }
 
diff --git a/callouts.example.yaml b/callouts.example.yaml
new file mode 100644
index 00000000..8bdb5789
--- /dev/null
+++ b/callouts.example.yaml
@@ -0,0 +1,97 @@
+# Atom callout configuration (example).
+#
+# Point Atom at this file with ATOM_CALLOUTS_FILE=/path/to/callouts.yaml.
+# Set ATOM_CALLOUTS_ENABLED=false to force-disable callouts without removing
+# the file (kill-switch). Environment overrides per endpoint:
+#
+#   ATOM_CALLOUT_<UPPER_ID>_URL           # HTTP endpoint url
+#   ATOM_CALLOUT_<UPPER_ID>_ADDRESS       # gRPC endpoint address
+#   ATOM_CALLOUT_<UPPER_ID>_TIMEOUT_MS
+#
+# Non-alphanumeric characters in the endpoint id are replaced with `_`
+# (so `policy-gate` → `POLICY_GATE`).
+#
+# Callouts run *after* authentication and *before* atom's own scope gates /
+# PDP / repo mutations. On a DENY, atom short-circuits the operation with the
+# reason returned by the external policy service. On transport error /
+# timeout the endpoint's `on_error:` policy applies (default: `deny` — atom's
+# default-deny invariant).
+#
+# Wire shape (both transports): see proto/atom/v1/callout.proto for the
+# canonical envelope. HTTP POST sends it as JSON; HTTP GET flattens it into
+# a query string (magistrala v0.14 parity).
+
+callouts:
+
+  # ── Reusable transport definitions. Each has an id referenced from `operations:`.
+  endpoints:
+
+    # HTTP POST — the common case. mTLS shown; drop `client_cert_path` /
+    # `client_key_path` for server-auth-only TLS, or drop the entire `tls:`
+    # block for plaintext (deployment must then confine the transport to a
+    # trusted network).
+    - id: policy-gate-http
+      transport: http
+      url: https://policy.internal/authz
+      method: POST                        # POST | GET (default POST)
+      timeout_ms: 500                     # default 500
+      headers:
+        X-Atom-Source: atom
+      tls:
+        ca_path: /etc/atom/certs/policy-ca.pem
+        client_cert_path: /etc/atom/certs/atom.pem
+        client_key_path:  /etc/atom/certs/atom.key
+        insecure_skip_verify: false
+      on_error: deny                      # deny | allow (default deny)
+
+    # gRPC transport — the external service must implement
+    # `atom.v1.callout.Callout/Check` (see proto/atom/v1/callout.proto).
+    - id: policy-gate-grpc
+      transport: grpc
+      address: https://policy.internal:9443
+      timeout_ms: 300
+      tls:
+        ca_path: /etc/atom/certs/policy-ca.pem
+        # mTLS optional — same fields as HTTP.
+        # `insecure_skip_verify` is not supported for gRPC (fails at startup).
+      on_error: deny
+
+  # ── Per-operation rules. If a GraphQL resolver or gRPC method is not
+  # listed here, no callout runs — the operation proceeds through atom's own
+  # gates untouched.
+  operations:
+
+    # GraphQL: resolver name matches. Multiple endpoints run in order and
+    # every one must ALLOW for the operation to proceed. On the first DENY,
+    # atom short-circuits with the endpoint's reason.
+    - name: createEntity
+      surface: graphql
+      endpoints: [policy-gate-http]
+      include:                            # Dot-path whitelist over the envelope.
+        - actor.entity_id
+        - actor.tenant_id
+        - args.input.name
+        - args.input.kind
+      extra:                              # Static kv merged into `extra`.
+        entity_type: entity
+
+    - name: revokeCredential
+      surface: graphql
+      endpoints: [policy-gate-http, policy-gate-grpc]  # both must allow
+      include:
+        - actor.entity_id
+        - args.id
+
+    # gRPC: fully-qualified method name — service/method. atom currently
+    # supports callout hooks on all gRPC methods; add or remove entries as
+    # needed. The `args` payload contains a hand-picked set of fields per
+    # method (see src/grpc.rs); the include list further narrows them.
+    - name: atom.v1.AuthzService/Check
+      surface: grpc
+      endpoints: [policy-gate-grpc]
+      include:
+        - actor.entity_id
+        - args.subject_id
+        - args.action
+        - args.object_kind
+        - args.object_id
diff --git a/migrations/005_managed_by.sql b/migrations/005_managed_by.sql
new file mode 100644
index 00000000..c5407911
--- /dev/null
+++ b/migrations/005_managed_by.sql
@@ -0,0 +1,18 @@
+-- Marks rows that were provisioned from a declarative bootstrap file (see
+-- src/bootstrap.rs) so mutation endpoints can refuse to modify them out of
+-- band. NULL = API-managed (default), 'config' = bootstrap-managed.
+-- Config-managed rows can still be added to (e.g. extra applicability rows
+-- attached to a config-managed capability), but they cannot be updated or
+-- deleted via the API — the config file is the source of truth.
+
+ALTER TABLE actions
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE action_applicability
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE action_assignment_rules
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
diff --git a/migrations/006_managed_by_identity.sql b/migrations/006_managed_by_identity.sql
new file mode 100644
index 00000000..13cdefbc
--- /dev/null
+++ b/migrations/006_managed_by_identity.sql
@@ -0,0 +1,14 @@
+-- Extends the `managed_by` marker from 005 to identity tables. Entities and
+-- credentials created from a bootstrap file (`src/bootstrap.rs`) are stamped
+-- 'config' so the API refuses to update, delete, revoke, or rotate them.
+-- Config-managed credentials are additionally hidden from list/read responses
+-- — the API pretends they don't exist so operator-planted tokens can never
+-- leak through introspection.
+
+ALTER TABLE entities
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE credentials
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
diff --git a/migrations/007_strip_product_specific_applicability.sql b/migrations/007_strip_product_specific_applicability.sql
new file mode 100644
index 00000000..e2126805
--- /dev/null
+++ b/migrations/007_strip_product_specific_applicability.sql
@@ -0,0 +1,18 @@
+-- Remove the two product-specific applicability rows migration 001 originally
+-- seeded for magistrala (`publish`/`subscribe` on `resource:channel`,
+-- `execute` on `resource:rule`). These are IoT-flavoured defaults that don't
+-- belong in a generic authorization service — each product ships its own
+-- vocabulary via the bootstrap config file (see src/bootstrap.rs
+-- `capabilities` section, and the companion PR in magistrala).
+--
+-- Kept as a separate migration rather than editing 001 in place: modifying an
+-- already-applied migration changes its checksum and makes sqlx refuse to
+-- start against any existing deployment. This delta migration is safe both
+-- for fresh installs (the rows are seeded by 001 and then removed here — a
+-- few wasted inserts, no functional change) and for upgrades.
+
+DELETE FROM action_applicability
+WHERE (object_kind, object_type) IN (
+    ('resource', 'resource:channel'),
+    ('resource', 'resource:rule')
+);
diff --git a/migrations/008_managed_by_rbac.sql b/migrations/008_managed_by_rbac.sql
new file mode 100644
index 00000000..faa68f0a
--- /dev/null
+++ b/migrations/008_managed_by_rbac.sql
@@ -0,0 +1,50 @@
+-- Extends the `managed_by` marker (introduced in 005/006) to the rest of the
+-- tables the bootstrap YAML populates: tenants, resources, principal_groups,
+-- object_groups, roles, permission_blocks, role_assignments, direct_policies.
+-- Rows stamped 'config' are refused by update/delete/restore endpoints so the
+-- deployment's declared graph can only be reshaped by editing the YAML and
+-- restarting Atom.
+
+ALTER TABLE tenants
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE resources
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE principal_groups
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE object_groups
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE roles
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE permission_blocks
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE role_assignments
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+ALTER TABLE direct_policies
+    ADD COLUMN IF NOT EXISTS managed_by TEXT
+        CHECK (managed_by IS NULL OR managed_by = 'config');
+
+-- The `groups` view unifies principal_groups and object_groups; recreate it
+-- with managed_by carried through from either underlying table.
+DROP VIEW IF EXISTS groups;
+CREATE VIEW groups AS
+SELECT id, name, tenant_id, 'object'::text AS group_type, description, status,
+       attributes, deleted_at, deleted_by, created_at, updated_at, managed_by
+FROM object_groups
+UNION ALL
+SELECT id, name, tenant_id, 'principal'::text AS group_type, description, status,
+       attributes, deleted_at, deleted_by, created_at, updated_at, managed_by
+FROM principal_groups;
diff --git a/proto/atom/v1/callout.proto b/proto/atom/v1/callout.proto
new file mode 100644
index 00000000..134934d2
--- /dev/null
+++ b/proto/atom/v1/callout.proto
@@ -0,0 +1,68 @@
+syntax = "proto3";
+
+package atom.v1.callout;
+
+import "google/protobuf/struct.proto";
+
+// Callout is the wire contract atom speaks with an external policy service.
+//
+// Atom sends one Check() per intercepted operation, before executing it. The
+// external service inspects the operation, actor and per-operation args, and
+// replies with ALLOW (proceed) or DENY (short-circuit with the given reason).
+// Multiple endpoints may be chained in config; atom calls them in order and
+// fails fast on the first non-ALLOW response.
+//
+// See docs in AGENTS.md and callouts.example.yaml for the config-side view.
+service Callout {
+  rpc Check(CalloutRequest) returns (CalloutResponse);
+}
+
+message CalloutRequest {
+  // Operation identifier — a GraphQL resolver name (e.g. "createEntity") or a
+  // fully-qualified gRPC method ("atom.v1.AuthzService/Check").
+  string operation = 1;
+
+  // Which atom surface the call is originating from.
+  string surface = 2;  // "graphql" | "grpc"
+
+  // Correlation id atom assigns to each callout request.
+  string request_id = 3;
+
+  // RFC-3339 UTC timestamp when the callout was issued.
+  string time = 4;
+
+  // The authenticated caller. Populated from atom's AuthContext post-authn,
+  // so it is safe to trust here for policy evaluation.
+  Actor actor = 5;
+
+  // The operation's arguments, filtered by the per-operation `include:` list
+  // in atom's config. A whitelist is applied and a hard denylist strips
+  // any obviously-sensitive keys (secret, password, key) as a safety net.
+  google.protobuf.Struct args = 6;
+
+  // Static key/value pairs merged in from config (`extra:` per operation).
+  google.protobuf.Struct extra = 7;
+}
+
+message Actor {
+  string entity_id     = 1;
+  string tenant_id     = 2;
+  string scope         = 3;  // "session" | "access_token" | ""
+  string credential_id = 4;
+  string source_ip     = 5;
+  string user_agent    = 6;
+}
+
+message CalloutResponse {
+  // DENY is the zero value on purpose: an unset/undecodable response evaluates
+  // to a deny, matching atom's default-deny invariant.
+  enum Decision {
+    DENY  = 0;
+    ALLOW = 1;
+  }
+
+  Decision decision = 1;
+
+  // Human-readable reason surfaced back to the caller on deny.
+  string reason = 2;
+}
diff --git a/src/auth.rs b/src/auth.rs
index 2948eafc..50dfdec9 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -136,7 +136,7 @@ pub fn make_api_key(cred_id: Uuid, secret_bytes: &[u8; 32]) -> String {
     format!("atom_{id_hex}_{secret_hex}")
 }
 
-fn parse_api_key(key: &str) -> Option<(Uuid, [u8; 32])> {
+pub fn parse_api_key(key: &str) -> Option<(Uuid, [u8; 32])> {
     let rest = key.strip_prefix("atom_")?;
     if rest.len() != 32 + 1 + 64 {
         return None;
diff --git a/src/authz/repo.rs b/src/authz/repo.rs
index 86923726..a5c7d893 100644
--- a/src/authz/repo.rs
+++ b/src/authz/repo.rs
@@ -111,7 +111,7 @@ where
     E: sqlx::Executor<'e, Database = sqlx::Postgres>,
 {
     sqlx::query_as::<_, Resource>(
-        "SELECT id, kind, name, alias, tenant_id, owner_id, attributes, deleted_at, deleted_by, created_at, updated_at FROM resources WHERE id = $1 AND deleted_at IS NULL",
+        "SELECT id, kind, name, alias, tenant_id, owner_id, attributes, deleted_at, deleted_by, created_at, updated_at, managed_by FROM resources WHERE id = $1 AND deleted_at IS NULL",
     )
     .bind(id)
     .fetch_one(executor)
@@ -164,7 +164,7 @@ pub async fn list_resources(
                WHERE $5::boolean
            )
            SELECT r.id, r.kind, r.name, r.alias, r.tenant_id, r.owner_id, r.attributes,
-                  r.deleted_at, r.deleted_by, r.created_at, r.updated_at
+                  r.deleted_at, r.deleted_by, r.created_at, r.updated_at, r.managed_by
            FROM resources r
            LEFT JOIN group_resource_parents grp ON grp.resource_id = r.id
            WHERE ($1::text IS NULL OR r.kind = $1)
@@ -234,6 +234,7 @@ pub async fn update_resource_with_audit(
     req: UpdateResource,
     updated_fields: Vec<&'static str>,
 ) -> Result<Resource, AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "resources", id).await?;
     let parent_group_id = req
         .attributes
         .as_ref()
@@ -326,6 +327,7 @@ pub async fn delete_resource_with_audit(
     id: Uuid,
     deleted_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "resources", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let tenant_id: Option<Option<Uuid>> =
         sqlx::query_scalar("SELECT tenant_id FROM resources WHERE id = $1 AND deleted_at IS NULL")
@@ -376,6 +378,7 @@ pub async fn restore_resource_with_audit(
     id: Uuid,
     restored_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "resources", id).await?;
     let _ = restored_by;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
@@ -1923,7 +1926,7 @@ pub async fn list_permission_blocks(
     let offset = params.offset.max(0);
     let items = sqlx::query_as::<_, PermissionBlock>(
         r#"SELECT id, tenant_id, scope_mode, object_kind, object_type, object_id, group_id,
-                  effect, conditions, created_at, updated_at
+                  effect, conditions, created_at, updated_at, managed_by
            FROM permission_blocks
            WHERE ($1::uuid IS NULL OR tenant_id = $1)
              AND ($2::text IS NULL OR scope_mode = $2)
@@ -2040,6 +2043,7 @@ pub async fn delete_permission_block_with_audit(
     actor_id: Option<Uuid>,
     id: Uuid,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "permission_blocks", id).await?;
     // Blocks are shared: refuse to delete one still linked to a role or attached
     // to a direct policy, so an explicit delete cannot cascade live links away.
     //
@@ -2253,7 +2257,7 @@ pub async fn list_roles(pool: &PgPool, params: ListRoles) -> Result<RoleList, Ap
     }
 
     let items = sqlx::query_as::<_, Role>(
-        r#"SELECT id, name, tenant_id, description, deleted_at, deleted_by, created_at, updated_at
+        r#"SELECT id, name, tenant_id, description, deleted_at, deleted_by, created_at, updated_at, managed_by
            FROM roles
            WHERE ($1::uuid IS NULL OR tenant_id = $1)
              AND ($2::text IS NULL OR name ILIKE $2 OR description ILIKE $2)
@@ -2796,6 +2800,7 @@ pub async fn delete_role_with_audit(
     id: Uuid,
     deleted_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "roles", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let tenant_id: Option<Option<Uuid>> =
         sqlx::query_scalar("SELECT tenant_id FROM roles WHERE id = $1 AND deleted_at IS NULL")
@@ -2845,6 +2850,7 @@ pub async fn restore_role_with_audit(
     id: Uuid,
     restored_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "roles", id).await?;
     let _ = restored_by;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
@@ -3110,7 +3116,7 @@ pub async fn create_capability_with_audit(
 
 pub async fn get_capability(pool: &PgPool, id: Uuid) -> Result<Capability, AppError> {
     sqlx::query_as::<_, Capability>(
-        "SELECT id, name, description, created_at, updated_at FROM actions WHERE id = $1",
+        "SELECT id, name, description, created_at, updated_at, managed_by FROM actions WHERE id = $1",
     )
     .bind(id)
     .fetch_one(pool)
@@ -3129,7 +3135,7 @@ pub async fn list_capabilities(
     let offset = params.offset.max(0);
 
     let items = sqlx::query_as::<_, Capability>(
-        r#"SELECT id, name, description, created_at, updated_at FROM actions c
+        r#"SELECT id, name, description, created_at, updated_at, managed_by FROM actions c
            WHERE (
                $1::text IS NULL
                OR EXISTS (
@@ -3177,7 +3183,7 @@ pub async fn capability_applicability(
     capability_id: Uuid,
 ) -> Result<Vec<CapabilityApplicability>, AppError> {
     sqlx::query_as::<_, CapabilityApplicability>(
-        r#"SELECT object_kind, object_type
+        r#"SELECT object_kind, object_type, managed_by
            FROM action_applicability
            WHERE action_id = $1
            ORDER BY object_kind, object_type NULLS FIRST"#,
@@ -3215,7 +3221,8 @@ pub async fn list_capability_applicability(
                   c.description,
                   ca.object_kind,
                   ca.object_type,
-                  ca.created_at
+                  ca.created_at,
+                  ca.managed_by
            FROM action_applicability ca
            JOIN actions c ON c.id = ca.action_id
            WHERE ($3::text IS NULL OR c.name ILIKE $3)
@@ -3257,7 +3264,7 @@ pub async fn get_action_assignment_rule(
 ) -> Result<ActionAssignmentRule, AppError> {
     sqlx::query_as::<_, ActionAssignmentRule>(
         r#"SELECT id, tenant_id, entity_kind, action_name, object_kind, object_type,
-                  decision, is_absolute, created_at
+                  decision, is_absolute, created_at, managed_by
            FROM action_assignment_rules
            WHERE id = $1"#,
     )
@@ -3284,7 +3291,7 @@ pub async fn list_action_assignment_rules(
 
     let items = sqlx::query_as::<_, ActionAssignmentRule>(
         r#"SELECT id, tenant_id, entity_kind, action_name, object_kind, object_type,
-                  decision, is_absolute, created_at
+                  decision, is_absolute, created_at, managed_by
            FROM action_assignment_rules
            WHERE tenant_id IS NOT DISTINCT FROM $3
              AND ($4::text IS NULL OR entity_kind = $4)
@@ -3458,6 +3465,7 @@ pub async fn delete_action_assignment_rule_with_audit(
     id: Uuid,
     transport: &str,
 ) -> Result<ActionAssignmentRule, AppError> {
+    ensure_not_config_managed_rule(pool, id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let rule = sqlx::query_as::<_, ActionAssignmentRule>(
         r#"DELETE FROM action_assignment_rules
@@ -3495,6 +3503,72 @@ pub async fn delete_action_assignment_rule_with_audit(
     Ok(rule)
 }
 
+async fn ensure_not_config_managed_capability(
+    pool: &PgPool,
+    capability_id: Uuid,
+) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> =
+        sqlx::query_scalar("SELECT managed_by FROM actions WHERE id = $1")
+            .bind(capability_id)
+            .fetch_optional(pool)
+            .await
+            .map_err(db_err)?;
+    match managed_by {
+        None => Err(AppError::not_found(format!(
+            "capability {capability_id} not found"
+        ))),
+        Some(Some(value)) if value == "config" => Err(AppError::conflict(
+            "capability is managed by the bootstrap config file and cannot be modified via the API",
+        )),
+        _ => Ok(()),
+    }
+}
+
+async fn ensure_not_config_managed_applicability(
+    pool: &PgPool,
+    capability_id: Uuid,
+    object_kind: &str,
+    object_type: Option<&str>,
+) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> = sqlx::query_scalar(
+        r#"SELECT managed_by FROM action_applicability
+           WHERE action_id = $1
+             AND object_kind = $2
+             AND object_type IS NOT DISTINCT FROM $3"#,
+    )
+    .bind(capability_id)
+    .bind(object_kind)
+    .bind(object_type)
+    .fetch_optional(pool)
+    .await
+    .map_err(db_err)?;
+    match managed_by {
+        None => Ok(()),
+        Some(Some(value)) if value == "config" => Err(AppError::conflict(
+            "capability applicability is managed by the bootstrap config file and cannot be modified via the API",
+        )),
+        _ => Ok(()),
+    }
+}
+
+async fn ensure_not_config_managed_rule(pool: &PgPool, id: Uuid) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> =
+        sqlx::query_scalar("SELECT managed_by FROM action_assignment_rules WHERE id = $1")
+            .bind(id)
+            .fetch_optional(pool)
+            .await
+            .map_err(db_err)?;
+    match managed_by {
+        None => Err(AppError::not_found(format!(
+            "action assignment rule {id} not found"
+        ))),
+        Some(Some(value)) if value == "config" => Err(AppError::conflict(
+            "action assignment rule is managed by the bootstrap config file and cannot be modified via the API",
+        )),
+        _ => Ok(()),
+    }
+}
+
 pub async fn add_capability_applicability(
     pool: &PgPool,
     capability_id: Uuid,
@@ -3552,7 +3626,8 @@ pub async fn add_capability_applicability_with_audit(
                   c.description,
                   ca.object_kind,
                   ca.object_type,
-                  ca.created_at
+                  ca.created_at,
+                  ca.managed_by
            FROM action_applicability ca
            JOIN actions c ON c.id = ca.action_id
            WHERE ca.action_id = $1
@@ -3607,6 +3682,13 @@ pub async fn remove_capability_applicability_with_audit(
     object_kind: String,
     object_type: Option<String>,
 ) -> Result<(), AppError> {
+    ensure_not_config_managed_applicability(
+        pool,
+        capability_id,
+        &object_kind,
+        object_type.as_deref(),
+    )
+    .await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let result = sqlx::query(
         r#"DELETE FROM action_applicability
@@ -3679,6 +3761,7 @@ pub async fn update_capability_with_audit(
     id: Uuid,
     req: crate::models::capability::UpdateCapability,
 ) -> Result<Capability, AppError> {
+    ensure_not_config_managed_capability(pool, id).await?;
     let mut tx = pool.begin().await.map_err(AppError::Database)?;
     let updated = sqlx::query_as::<_, Capability>(
         r#"UPDATE actions
@@ -3723,6 +3806,23 @@ async fn replace_capability_applicability_in_tx(
     capability_id: Uuid,
     applicability: &[CapabilityApplicabilityInput],
 ) -> Result<(), AppError> {
+    // Refuse to blow away applicability rows that were declared in the
+    // bootstrap config, even when the parent capability itself is API-managed.
+    let has_managed: bool = sqlx::query_scalar(
+        "SELECT EXISTS (SELECT 1 FROM action_applicability
+                        WHERE action_id = $1 AND managed_by = 'config')",
+    )
+    .bind(capability_id)
+    .fetch_one(&mut **tx)
+    .await
+    .map_err(db_err)?;
+    if has_managed {
+        return Err(AppError::conflict(
+            "capability has applicability rows managed by the bootstrap config file; \
+             use addCapabilityApplicability / removeCapabilityApplicability instead",
+        ));
+    }
+
     sqlx::query("DELETE FROM action_applicability WHERE action_id = $1")
         .bind(capability_id)
         .execute(&mut **tx)
@@ -3760,6 +3860,7 @@ pub async fn delete_capability_with_audit(
     actor_id: Option<Uuid>,
     id: Uuid,
 ) -> Result<(), AppError> {
+    ensure_not_config_managed_capability(pool, id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let result = sqlx::query("DELETE FROM actions WHERE id = $1")
         .bind(id)
@@ -4035,6 +4136,7 @@ pub async fn delete_role_assignment_with_audit(
     actor_id: Option<Uuid>,
     id: Uuid,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "role_assignments", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let assignment_tenant_id: Option<Option<Uuid>> =
         sqlx::query_scalar("SELECT tenant_id FROM role_assignments WHERE id = $1")
@@ -4122,7 +4224,7 @@ pub async fn list_role_assignments(
     let limit = params.limit.clamp(1, 100);
     let offset = params.offset.max(0);
     let items = sqlx::query_as::<_, RoleAssignment>(
-        r#"SELECT id, tenant_id, subject_kind, subject_id, role_id, created_at
+        r#"SELECT id, tenant_id, subject_kind, subject_id, role_id, created_at, managed_by
            FROM role_assignments
            WHERE ($1::uuid IS NULL OR tenant_id = $1)
              AND ($2::text IS NULL OR subject_kind = $2)
@@ -4246,7 +4348,7 @@ pub async fn list_direct_policies(
     let limit = params.limit.clamp(1, 100);
     let offset = params.offset.max(0);
     let items = sqlx::query_as::<_, DirectPolicy>(
-        r#"SELECT id, tenant_id, subject_kind, subject_id, permission_block_id, created_at
+        r#"SELECT id, tenant_id, subject_kind, subject_id, permission_block_id, created_at, managed_by
            FROM direct_policies
            WHERE ($1::uuid IS NULL OR tenant_id = $1)
              AND ($2::text IS NULL OR subject_kind = $2)
@@ -4313,6 +4415,7 @@ pub async fn delete_direct_policy_with_audit(
     actor_id: Option<Uuid>,
     id: Uuid,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "direct_policies", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let policy_tenant_id: Option<Option<Uuid>> =
         sqlx::query_scalar("SELECT tenant_id FROM direct_policies WHERE id = $1")
@@ -4645,6 +4748,10 @@ pub async fn subject_role_assignments(
                     deleted_by: None,
                     created_at: row.try_get("role_created_at").map_err(db_err)?,
                     updated_at: row.try_get("role_updated_at").map_err(db_err)?,
+                    // Explain view; only surfaces role identity, not lifecycle
+                    // metadata. Leave managed_by unset — the UI reads it via
+                    // list_roles / get_role, not this SELECT.
+                    managed_by: None,
                 },
             })
         })
diff --git a/src/bootstrap.rs b/src/bootstrap.rs
new file mode 100644
index 00000000..9656a040
--- /dev/null
+++ b/src/bootstrap.rs
@@ -0,0 +1,1884 @@
+//! Declarative startup bootstrap from a YAML configuration file.
+//!
+//! Standing up a fresh Atom deployment previously meant either setting a handful
+//! of `*_SECRET` env vars or driving the API by hand to create the initial
+//! tenants, entities, roles and policies. Neither is friendly for repeatable,
+//! reviewable platform management.
+//!
+//! This module lets an operator describe the desired baseline in a single YAML
+//! file (pointed to by `ATOM_BOOTSTRAP_FILE`). The file is loaded once at
+//! startup, right after migrations, and applied **idempotently**: every record
+//! is keyed on a stable UUID and inserted with `ON CONFLICT DO NOTHING`, so
+//! re-running against an already-provisioned database is a no-op and never
+//! clobbers runtime changes. It runs *alongside* the env-var bootstrap, not
+//! instead of it.
+//!
+//! It provisions the full RBAC graph, applied in dependency order:
+//! tenants → entities (+ credentials) → resources → principal groups
+//! (+ members) → object groups (+ members, hierarchy) → permission blocks
+//! (+ actions) → roles (+ block links) → role assignments → direct policies.
+//! Records may reference rows that already exist in the database (for example
+//! the pre-seeded `admin` entity or `atom-admin` role); foreign-key violations
+//! for genuinely missing references abort startup.
+//!
+//! ## Example
+//!
+//! ```yaml
+//! tenants:
+//!   - id: 33333333-3333-3333-3333-333333333333
+//!     name: factory
+//!     alias: factory
+//!
+//! entities:
+//!   - id: 22222222-2222-2222-2222-222222222222
+//!     kind: device
+//!     name: gateway-01
+//!     tenant_id: 33333333-3333-3333-3333-333333333333
+//!     credentials:
+//!       - kind: shared_key
+//!         key: a-strong-device-secret
+//!
+//! permission_blocks:
+//!   - id: 44444444-4444-4444-4444-444444444444
+//!     scope:
+//!       mode: object_type
+//!       tenant_id: 33333333-3333-3333-3333-333333333333
+//!       object_kind: resource
+//!       object_type: resource:channel
+//!     actions: [publish, subscribe]
+//!     effect: allow
+//!
+//! roles:
+//!   - id: 55555555-5555-5555-5555-555555555555
+//!     name: publisher
+//!     tenant_id: 33333333-3333-3333-3333-333333333333
+//!     permission_blocks: [44444444-4444-4444-4444-444444444444]
+//!
+//! role_assignments:
+//!   - id: 66666666-6666-6666-6666-666666666666
+//!     tenant_id: 33333333-3333-3333-3333-333333333333
+//!     subject: { kind: entity, id: 22222222-2222-2222-2222-222222222222 }
+//!     role_id: 55555555-5555-5555-5555-555555555555
+//! ```
+
+use std::collections::HashSet;
+use std::path::Path;
+
+use anyhow::{anyhow, bail, Context, Result};
+use serde::Deserialize;
+use serde_json::Value;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::config::SigningKeyConfig;
+use crate::identity;
+use crate::models::alias::validate_alias_opt;
+use crate::models::enums::{
+    ActionAssignmentDecision, CredentialKind, Effect, EntityKind, EntityStatus, ObjectKind,
+    SubjectKind, TenantStatus,
+};
+use crate::models::token::CreateSharedKey;
+
+/// Sentinel written to `managed_by` columns for rows provisioned from a
+/// bootstrap file. Mutation endpoints refuse to touch rows carrying this tag.
+pub const MANAGED_BY_CONFIG: &str = "config";
+
+/// Root of the bootstrap document. Every section is optional.
+#[derive(Debug, Clone, Deserialize, PartialEq, Default)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapConfig {
+    #[serde(default)]
+    pub tenants: Vec<BootstrapTenant>,
+    #[serde(default)]
+    pub entities: Vec<BootstrapEntity>,
+    #[serde(default)]
+    pub resources: Vec<BootstrapResource>,
+    #[serde(default)]
+    pub groups: Vec<BootstrapGroup>,
+    #[serde(default)]
+    pub object_groups: Vec<BootstrapObjectGroup>,
+    #[serde(default)]
+    pub permission_blocks: Vec<BootstrapPermissionBlock>,
+    #[serde(default)]
+    pub roles: Vec<BootstrapRole>,
+    #[serde(default)]
+    pub role_assignments: Vec<BootstrapRoleAssignment>,
+    #[serde(default)]
+    pub direct_policies: Vec<BootstrapDirectPolicy>,
+    /// Additional action names (capabilities) beyond the built-in vocabulary,
+    /// e.g. product-specific verbs like `publish` or `alarm.acknowledge`. Each
+    /// entry may also declare the object kinds/types it applies to.
+    #[serde(default)]
+    pub capabilities: Vec<BootstrapCapability>,
+    /// Guardrail rules constraining which entity kinds may perform which
+    /// actions on which object kinds — the platform-wide "device cannot manage
+    /// resources" style rails.
+    #[serde(default)]
+    pub action_assignment_rules: Vec<BootstrapActionAssignmentRule>,
+}
+
+/// A tenant (domain). `None` `tenant_id` on other records means platform scope.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapTenant {
+    pub id: Uuid,
+    pub name: String,
+    #[serde(default)]
+    pub alias: Option<String>,
+    #[serde(default)]
+    pub tags: Vec<String>,
+    #[serde(default)]
+    pub attributes: Option<Value>,
+    #[serde(default)]
+    pub status: TenantStatus,
+}
+
+/// An entity, together with its credentials.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapEntity {
+    /// Stable UUID — the key we upsert on. Use the well-known seed UUIDs to
+    /// attach credentials to the pre-seeded `admin`/`example-service` entities.
+    pub id: Uuid,
+    pub kind: EntityKind,
+    pub name: String,
+    #[serde(default)]
+    pub alias: Option<String>,
+    #[serde(default)]
+    pub status: EntityStatus,
+    #[serde(default)]
+    pub attributes: Option<Value>,
+    /// Owning tenant. `None` places the entity at platform scope.
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    #[serde(default)]
+    pub credentials: Vec<BootstrapCredential>,
+}
+
+/// A credential to ensure exists for an entity. The secret material is declared
+/// inline, exactly like the existing `ADMIN_SECRET` env var — protect the file
+/// accordingly (mount it as a secret, keep it out of version control).
+// `deny_unknown_fields` is intentionally omitted: serde does not support it on
+// internally tagged enums (it would reject the `kind` discriminant itself).
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum BootstrapCredential {
+    /// A password credential. Validated against the configured strength policy.
+    Password { secret: String },
+    /// A retrievable machine shared key. Only valid for non-human entities. The
+    /// key must be supplied explicitly so bootstrap stays deterministic (an
+    /// auto-generated key would be lost, never surfaced to the operator).
+    SharedKey {
+        key: String,
+        #[serde(default)]
+        description: Option<String>,
+    },
+    /// A pre-provisioned unscoped access token (`atom_<id_hex>_<secret_hex>`).
+    /// The operator generates the token once (e.g. from `openssl rand`) and
+    /// splices the same value into both this YAML *and* the env file consumed
+    /// by downstream services — so `docker compose up` needs no round-trip
+    /// between an atom-bootstrap init container and services waiting on it.
+    /// The credential row is stamped `managed_by='config'`, so the API refuses
+    /// to revoke it and hides it from list/read responses.
+    AccessToken {
+        /// Full `atom_<id_hex>_<secret_hex>` token string.
+        token: String,
+        /// Human label for the token, surfaced in audit logs.
+        name: String,
+        #[serde(default)]
+        description: Option<String>,
+    },
+}
+
+/// A protected resource object (e.g. a `channel`). `kind` is a free-form label.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapResource {
+    pub id: Uuid,
+    pub kind: String,
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub alias: Option<String>,
+    /// Owning tenant. `None` places the resource at platform scope.
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    /// Optional owning entity.
+    #[serde(default)]
+    pub owner_id: Option<Uuid>,
+    #[serde(default)]
+    pub attributes: Option<Value>,
+}
+
+/// A principal (subject) group and its entity members.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapGroup {
+    pub id: Uuid,
+    pub name: String,
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub attributes: Option<Value>,
+    /// Entity IDs that belong to this group.
+    #[serde(default)]
+    pub members: Vec<Uuid>,
+}
+
+/// An object group: groups entities and/or resources so a single permission
+/// block can scope to all of them (and, via `parent`, to descendant groups).
+/// An entity or resource belongs to at most one object group. Membership rows
+/// require a tenant, so a group with members must declare `tenant_id`.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapObjectGroup {
+    pub id: Uuid,
+    pub name: String,
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub attributes: Option<Value>,
+    /// Parent object group (this group becomes its child in the hierarchy).
+    #[serde(default)]
+    pub parent: Option<Uuid>,
+    /// Entity IDs that belong to this group.
+    #[serde(default)]
+    pub entities: Vec<Uuid>,
+    /// Resource IDs that belong to this group.
+    #[serde(default)]
+    pub resources: Vec<Uuid>,
+}
+
+/// A permission block: scope + actions + effect + conditions. Shared — link it
+/// to roles (`roles[].permission_blocks`) and/or grant it directly to subjects
+/// (`direct_policies[].permission_block_id`).
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapPermissionBlock {
+    pub id: Uuid,
+    pub scope: BootstrapScope,
+    /// Action names (e.g. `read`, `publish`). Resolved to seeded action IDs.
+    #[serde(default)]
+    pub actions: Vec<String>,
+    #[serde(default)]
+    pub effect: Effect,
+    #[serde(default)]
+    pub conditions: Option<Value>,
+}
+
+/// Permission-block scope modes. The `group_*` modes scope a block to the
+/// members (or descendant groups) of an object group, referenced by
+/// `scope.group_id`.
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ScopeMode {
+    Platform,
+    Tenant,
+    ObjectKind,
+    ObjectType,
+    Object,
+    /// A namespaced object type among the direct entity/resource members of the
+    /// object group (needs `object_kind` + `object_type`).
+    GroupDirectObjects,
+    /// Like `group_direct_objects`, extended to descendant groups.
+    GroupDescendantObjects,
+    /// Direct child groups of the object group.
+    GroupChildGroups,
+    /// Descendant groups of the object group.
+    GroupDescendantGroups,
+}
+
+impl ScopeMode {
+    fn as_str(self) -> &'static str {
+        match self {
+            ScopeMode::Platform => "platform",
+            ScopeMode::Tenant => "tenant",
+            ScopeMode::ObjectKind => "object_kind",
+            ScopeMode::ObjectType => "object_type",
+            ScopeMode::Object => "object",
+            ScopeMode::GroupDirectObjects => "group_direct_objects",
+            ScopeMode::GroupDescendantObjects => "group_descendant_objects",
+            ScopeMode::GroupChildGroups => "group_child_groups",
+            ScopeMode::GroupDescendantGroups => "group_descendant_groups",
+        }
+    }
+
+    fn is_group(self) -> bool {
+        matches!(
+            self,
+            ScopeMode::GroupDirectObjects
+                | ScopeMode::GroupDescendantObjects
+                | ScopeMode::GroupChildGroups
+                | ScopeMode::GroupDescendantGroups
+        )
+    }
+}
+
+/// Scope of a permission block. Which fields are required depends on `mode`;
+/// [`BootstrapScope::validate`] mirrors the database CHECK constraint so a bad
+/// combination is rejected before insert.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapScope {
+    pub mode: ScopeMode,
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    #[serde(default)]
+    pub object_kind: Option<String>,
+    #[serde(default)]
+    pub object_type: Option<String>,
+    #[serde(default)]
+    pub object_id: Option<Uuid>,
+    /// Object group the block scopes to (required by the `group_*` modes).
+    #[serde(default)]
+    pub group_id: Option<Uuid>,
+}
+
+impl BootstrapScope {
+    fn validate(&self, block_id: Uuid) -> Result<()> {
+        let has_kind = self.object_kind.is_some();
+        let has_type = self.object_type.is_some();
+        let has_object = self.object_id.is_some();
+        let has_tenant = self.tenant_id.is_some();
+        let has_group = self.group_id.is_some();
+        let require = |cond: bool, msg: &str| -> Result<()> {
+            if cond {
+                Ok(())
+            } else {
+                Err(anyhow!("permission block {block_id}: {msg}"))
+            }
+        };
+        // group_id belongs only to the group_* modes.
+        if !self.mode.is_group() {
+            require(!has_group, "only group_* scopes take a group_id")?;
+        }
+        match self.mode {
+            ScopeMode::Platform => {
+                require(
+                    !has_tenant && !has_kind && !has_type && !has_object,
+                    "platform scope takes no tenant_id/object_kind/object_type/object_id",
+                )?;
+            }
+            ScopeMode::Tenant => {
+                require(has_tenant, "tenant scope requires tenant_id")?;
+                require(
+                    !has_kind && !has_type && !has_object,
+                    "tenant scope takes no object_kind/object_type/object_id",
+                )?;
+            }
+            ScopeMode::ObjectKind => {
+                require(
+                    has_tenant && has_kind,
+                    "object_kind scope requires tenant_id and object_kind",
+                )?;
+                require(
+                    !has_type && !has_object,
+                    "object_kind scope takes no object_type/object_id",
+                )?;
+            }
+            ScopeMode::ObjectType => {
+                require(
+                    has_tenant && has_kind && has_type,
+                    "object_type scope requires tenant_id, object_kind and object_type",
+                )?;
+                require(!has_object, "object_type scope takes no object_id")?;
+            }
+            ScopeMode::Object => {
+                require(has_object, "object scope requires object_id")?;
+                require(
+                    !has_kind && !has_type,
+                    "object scope takes no object_kind/object_type",
+                )?;
+            }
+            ScopeMode::GroupChildGroups | ScopeMode::GroupDescendantGroups => {
+                require(
+                    has_tenant && has_group,
+                    "group scopes require tenant_id and group_id",
+                )?;
+                require(
+                    !has_kind && !has_type && !has_object,
+                    "this group scope takes no object_kind/object_type/object_id",
+                )?;
+            }
+            ScopeMode::GroupDirectObjects | ScopeMode::GroupDescendantObjects => {
+                require(
+                    has_tenant && has_group,
+                    "group object scopes require tenant_id and group_id",
+                )?;
+                let kind_ok = matches!(
+                    self.object_kind.as_deref(),
+                    Some("entity") | Some("resource")
+                );
+                require(
+                    kind_ok,
+                    "group object scopes require object_kind of 'entity' or 'resource'",
+                )?;
+                // The scope_ref is `<group>:<object_type>` (e.g.
+                // `resource:channel`); without object_type the scope never
+                // matches, so require it rather than ship a dead grant.
+                require(
+                    has_type,
+                    "group object scopes require object_type (e.g. 'resource:channel')",
+                )?;
+                require(!has_object, "group object scopes take no object_id")?;
+            }
+        }
+        Ok(())
+    }
+}
+
+/// A role, optionally linked to permission blocks defined above.
+#[derive(Debug, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapRole {
+    pub id: Uuid,
+    pub name: String,
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    #[serde(default)]
+    pub description: Option<String>,
+    /// IDs of permission blocks to attach to this role.
+    #[serde(default)]
+    pub permission_blocks: Vec<Uuid>,
+}
+
+/// The subject of an assignment or direct policy.
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapSubject {
+    pub kind: SubjectKind,
+    pub id: Uuid,
+}
+
+/// Grants a role to a subject.
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapRoleAssignment {
+    pub id: Uuid,
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    pub subject: BootstrapSubject,
+    pub role_id: Uuid,
+}
+
+/// Grants a permission block directly to a subject.
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapDirectPolicy {
+    pub id: Uuid,
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    pub subject: BootstrapSubject,
+    pub permission_block_id: Uuid,
+}
+
+/// A capability (action) to ensure exists. Keyed on `name` (the unique column
+/// on `actions`), so re-running the bootstrap file is a no-op. The optional
+/// `applicability` block lists object kinds/types this action can target;
+/// entries are additive (existing applicability rows are not removed).
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapCapability {
+    pub name: String,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub applicability: Vec<BootstrapCapabilityApplicability>,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapCapabilityApplicability {
+    pub object_kind: ObjectKind,
+    #[serde(default)]
+    pub object_type: Option<String>,
+}
+
+/// A guardrail rule. Same shape as the `action_assignment_rules` row, minus
+/// the auto-generated id.
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapActionAssignmentRule {
+    #[serde(default)]
+    pub tenant_id: Option<Uuid>,
+    pub entity_kind: EntityKind,
+    pub action_name: String,
+    pub object_kind: ObjectKind,
+    #[serde(default)]
+    pub object_type: Option<String>,
+    pub decision: ActionAssignmentDecision,
+    #[serde(default)]
+    pub is_absolute: bool,
+}
+
+impl BootstrapConfig {
+    /// Structural validation performed before touching the database, so a
+    /// malformed file aborts startup with a clear message instead of a partial,
+    /// half-applied bootstrap.
+    pub fn validate(&self) -> Result<()> {
+        unique_ids(self.tenants.iter().map(|t| t.id), "tenant")?;
+        unique_ids(self.entities.iter().map(|e| e.id), "entity")?;
+        unique_ids(self.resources.iter().map(|r| r.id), "resource")?;
+        unique_ids(self.groups.iter().map(|g| g.id), "group")?;
+        unique_ids(self.object_groups.iter().map(|g| g.id), "object group")?;
+        unique_ids(
+            self.permission_blocks.iter().map(|b| b.id),
+            "permission block",
+        )?;
+        unique_ids(self.roles.iter().map(|r| r.id), "role")?;
+        unique_ids(
+            self.role_assignments.iter().map(|a| a.id),
+            "role assignment",
+        )?;
+        unique_ids(self.direct_policies.iter().map(|p| p.id), "direct policy")?;
+
+        for tenant in &self.tenants {
+            if tenant.name.trim().is_empty() {
+                bail!("bootstrap tenant {} has an empty name", tenant.id);
+            }
+            check_object_attributes(&tenant.attributes, "tenant", tenant.id)?;
+        }
+        for entity in &self.entities {
+            entity.validate()?;
+        }
+        for resource in &self.resources {
+            if resource.kind.trim().is_empty() {
+                bail!("bootstrap resource {} has an empty kind", resource.id);
+            }
+            check_object_attributes(&resource.attributes, "resource", resource.id)?;
+        }
+        for group in &self.groups {
+            if group.name.trim().is_empty() {
+                bail!("bootstrap group {} has an empty name", group.id);
+            }
+            check_object_attributes(&group.attributes, "group", group.id)?;
+        }
+        for group in &self.object_groups {
+            if group.name.trim().is_empty() {
+                bail!("bootstrap object group {} has an empty name", group.id);
+            }
+            check_object_attributes(&group.attributes, "object group", group.id)?;
+            if group.parent == Some(group.id) {
+                bail!(
+                    "bootstrap object group {} cannot be its own parent",
+                    group.id
+                );
+            }
+            // Membership rows carry a NOT NULL tenant_id, so a group with
+            // members must declare its tenant.
+            if group.tenant_id.is_none()
+                && (!group.entities.is_empty() || !group.resources.is_empty())
+            {
+                bail!(
+                    "bootstrap object group {} has members but no tenant_id",
+                    group.id
+                );
+            }
+        }
+        for block in &self.permission_blocks {
+            block.scope.validate(block.id)?;
+            if let Some(conditions) = &block.conditions {
+                if !conditions.is_object() {
+                    bail!(
+                        "permission block {} conditions must be a JSON object",
+                        block.id
+                    );
+                }
+            }
+        }
+        for role in &self.roles {
+            if role.name.trim().is_empty() {
+                bail!("bootstrap role {} has an empty name", role.id);
+            }
+        }
+
+        let mut seen_names = HashSet::new();
+        for capability in &self.capabilities {
+            let name = capability.name.trim();
+            if name.is_empty() {
+                bail!("bootstrap capability has an empty name");
+            }
+            if !seen_names.insert(name.to_string()) {
+                bail!("duplicate bootstrap capability name {name}");
+            }
+            let mut seen_apps = HashSet::new();
+            for app in &capability.applicability {
+                let key = (app.object_kind, app.object_type.clone());
+                if !seen_apps.insert(key) {
+                    bail!(
+                        "capability {name} declares duplicate applicability {}:{}",
+                        app.object_kind.as_str(),
+                        app.object_type.as_deref().unwrap_or("")
+                    );
+                }
+            }
+        }
+
+        let mut seen_rules = HashSet::new();
+        for rule in &self.action_assignment_rules {
+            let action = rule.action_name.trim();
+            if action.is_empty() {
+                bail!("bootstrap action_assignment_rule has an empty action_name");
+            }
+            let key = (
+                rule.tenant_id,
+                format!("{:?}", rule.entity_kind),
+                action.to_string(),
+                rule.object_kind,
+                rule.object_type.clone(),
+            );
+            if !seen_rules.insert(key) {
+                bail!(
+                    "duplicate bootstrap action_assignment_rule for {} {} on {}:{}",
+                    format!("{:?}", rule.entity_kind).to_lowercase(),
+                    action,
+                    rule.object_kind.as_str(),
+                    rule.object_type.as_deref().unwrap_or("")
+                );
+            }
+        }
+        Ok(())
+    }
+}
+
+impl BootstrapEntity {
+    fn validate(&self) -> Result<()> {
+        if self.name.trim().is_empty() {
+            bail!("bootstrap entity {} has an empty name", self.id);
+        }
+        check_object_attributes(&self.attributes, "entity", self.id)?;
+
+        let mut passwords = 0;
+        let mut shared_keys = 0;
+        let mut access_tokens = HashSet::new();
+        for cred in &self.credentials {
+            match cred {
+                BootstrapCredential::Password { .. } => passwords += 1,
+                BootstrapCredential::SharedKey { .. } => {
+                    shared_keys += 1;
+                    if !CredentialKind::SharedKey.allowed_for(&self.kind) {
+                        bail!(
+                            "bootstrap entity {} is a human; shared keys are only valid for machine entities",
+                            self.id
+                        );
+                    }
+                }
+                BootstrapCredential::AccessToken { token, name, .. } => {
+                    if name.trim().is_empty() {
+                        bail!(
+                            "bootstrap entity {} declares an access token with an empty name",
+                            self.id
+                        );
+                    }
+                    let (cred_id, _) = crate::auth::parse_api_key(token.trim()).ok_or_else(
+                        || anyhow!(
+                            "bootstrap entity {} declares an access token that is not a valid atom_<id>_<secret> string",
+                            self.id
+                        ),
+                    )?;
+                    if !access_tokens.insert(cred_id) {
+                        bail!(
+                            "bootstrap entity {} declares more than one access token with credential id {cred_id}",
+                            self.id
+                        );
+                    }
+                }
+            }
+        }
+        if passwords > 1 {
+            bail!(
+                "bootstrap entity {} declares more than one password credential",
+                self.id
+            );
+        }
+        if shared_keys > 1 {
+            bail!(
+                "bootstrap entity {} declares more than one shared_key credential",
+                self.id
+            );
+        }
+        Ok(())
+    }
+}
+
+fn unique_ids(ids: impl Iterator<Item = Uuid>, label: &str) -> Result<()> {
+    let mut seen = HashSet::new();
+    for id in ids {
+        if !seen.insert(id) {
+            bail!("duplicate bootstrap {label} id {id}");
+        }
+    }
+    Ok(())
+}
+
+fn check_object_attributes(attributes: &Option<Value>, label: &str, id: Uuid) -> Result<()> {
+    if let Some(attrs) = attributes {
+        if !attrs.is_object() {
+            bail!("bootstrap {label} {id} attributes must be a JSON object");
+        }
+    }
+    Ok(())
+}
+
+/// Read and parse a bootstrap file, validating its structure.
+pub fn load(path: &Path) -> Result<BootstrapConfig> {
+    let contents = std::fs::read_to_string(path)
+        .with_context(|| format!("failed to read bootstrap file {}", path.display()))?;
+    parse(&contents).with_context(|| format!("invalid bootstrap file {}", path.display()))
+}
+
+fn parse(contents: &str) -> Result<BootstrapConfig> {
+    let cfg: BootstrapConfig = serde_yaml::from_str(contents).context("failed to parse YAML")?;
+    cfg.validate()?;
+    Ok(cfg)
+}
+
+/// Apply the bootstrap config against the database, in dependency order.
+/// Idempotent.
+pub async fn apply(
+    pool: &PgPool,
+    signing_keys: &SigningKeyConfig,
+    cfg: &BootstrapConfig,
+) -> Result<()> {
+    for tenant in &cfg.tenants {
+        ensure_tenant(pool, tenant).await?;
+    }
+    for entity in &cfg.entities {
+        ensure_entity(pool, entity).await?;
+        for cred in &entity.credentials {
+            ensure_credential(pool, signing_keys, entity, cred).await?;
+        }
+    }
+    for resource in &cfg.resources {
+        ensure_resource(pool, resource).await?;
+    }
+    for group in &cfg.groups {
+        ensure_group(pool, group).await?;
+    }
+    // Object group rows first, then hierarchy/membership, so a parent declared
+    // later in the file still resolves.
+    for group in &cfg.object_groups {
+        ensure_object_group(pool, group).await?;
+    }
+    for group in &cfg.object_groups {
+        ensure_object_group_links(pool, group).await?;
+    }
+    for block in &cfg.permission_blocks {
+        ensure_permission_block(pool, block).await?;
+    }
+    for role in &cfg.roles {
+        ensure_role(pool, role).await?;
+    }
+    for assignment in &cfg.role_assignments {
+        ensure_role_assignment(pool, assignment).await?;
+    }
+    for policy in &cfg.direct_policies {
+        ensure_direct_policy(pool, policy).await?;
+    }
+    for capability in &cfg.capabilities {
+        ensure_capability(pool, capability).await?;
+    }
+    for rule in &cfg.action_assignment_rules {
+        ensure_action_assignment_rule(pool, rule).await?;
+    }
+    Ok(())
+}
+
+async fn ensure_tenant(pool: &PgPool, tenant: &BootstrapTenant) -> Result<()> {
+    let alias = validate_alias_opt(tenant.alias.clone())
+        .map_err(|e| anyhow!("bootstrap tenant {}: {e}", tenant.id))?;
+    let attributes = tenant
+        .attributes
+        .clone()
+        .unwrap_or_else(|| serde_json::json!({}));
+
+    let result = sqlx::query(
+        r#"INSERT INTO tenants (id, name, alias, status, tags, attributes)
+           VALUES ($1, $2, $3, $4, $5, $6)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(tenant.id)
+    .bind(&tenant.name)
+    .bind(alias)
+    .bind(&tenant.status)
+    .bind(&tenant.tags)
+    .bind(attributes)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap tenant {}", tenant.id))?;
+
+    stamp_managed_by_config(pool, "tenants", tenant.id).await?;
+    log_upsert(result.rows_affected(), "tenant", tenant.id);
+    Ok(())
+}
+
+/// Create the entity if its UUID is not already present. Existing rows are left
+/// untouched, so a bootstrap re-run never overwrites runtime edits. The row is
+/// stamped `managed_by='config'` so update/delete/restore endpoints refuse to
+/// touch it via the API.
+async fn ensure_entity(pool: &PgPool, entity: &BootstrapEntity) -> Result<()> {
+    let alias = validate_alias_opt(entity.alias.clone())
+        .map_err(|e| anyhow!("bootstrap entity {}: {e}", entity.id))?;
+    let attributes = entity
+        .attributes
+        .clone()
+        .unwrap_or_else(|| serde_json::json!({}));
+
+    let result = sqlx::query(
+        r#"INSERT INTO entities (id, kind, name, alias, tenant_id, status, attributes, managed_by)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(entity.id)
+    .bind(&entity.kind)
+    .bind(&entity.name)
+    .bind(alias)
+    .bind(entity.tenant_id)
+    .bind(&entity.status)
+    .bind(attributes)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap entity {}", entity.id))?;
+
+    // Stamp even when the row already existed, so an entity created earlier via
+    // the API becomes protected once it appears in the bootstrap file.
+    sqlx::query("UPDATE entities SET managed_by = $2 WHERE id = $1")
+        .bind(entity.id)
+        .bind(MANAGED_BY_CONFIG)
+        .execute(pool)
+        .await
+        .with_context(|| format!("failed to stamp bootstrap entity {}", entity.id))?;
+
+    log_upsert(result.rows_affected(), "entity", entity.id);
+    Ok(())
+}
+
+/// Create the credential only if the entity has no active credential of that
+/// kind yet. Reuses the identity service so hashing, strength validation and
+/// shared-key envelope encryption stay identical to the API path. Every
+/// bootstrap-created credential is stamped `managed_by='config'`, which both
+/// blocks API mutations and hides the row from list/read responses.
+async fn ensure_credential(
+    pool: &PgPool,
+    signing_keys: &SigningKeyConfig,
+    entity: &BootstrapEntity,
+    cred: &BootstrapCredential,
+) -> Result<()> {
+    match cred {
+        BootstrapCredential::Password { secret } => {
+            if active_credential_exists(pool, entity.id, CredentialKind::Password).await? {
+                tracing::info!(entity_id = %entity.id, "bootstrap: password already present, skipped");
+                return Ok(());
+            }
+            identity::service::create_password(pool, entity.id, secret)
+                .await
+                .map_err(|e| anyhow!("bootstrap password for entity {}: {e}", entity.id))?;
+            stamp_managed_credentials(pool, entity.id, CredentialKind::Password).await?;
+            tracing::info!(entity_id = %entity.id, "bootstrap: password credential created");
+        }
+        BootstrapCredential::SharedKey { key, description } => {
+            if active_credential_exists(pool, entity.id, CredentialKind::SharedKey).await? {
+                tracing::info!(entity_id = %entity.id, "bootstrap: shared key already present, skipped");
+                return Ok(());
+            }
+            identity::service::create_shared_key(
+                pool,
+                signing_keys,
+                entity.id,
+                CreateSharedKey {
+                    expires_at: None,
+                    description: description.clone(),
+                    key: Some(key.clone()),
+                },
+            )
+            .await
+            .map_err(|e| anyhow!("bootstrap shared key for entity {}: {e}", entity.id))?;
+            stamp_managed_credentials(pool, entity.id, CredentialKind::SharedKey).await?;
+            tracing::info!(entity_id = %entity.id, "bootstrap: shared key credential created");
+        }
+        BootstrapCredential::AccessToken {
+            token,
+            name,
+            description,
+        } => {
+            ensure_bootstrap_access_token(pool, signing_keys, entity, token, name, description)
+                .await?;
+        }
+    }
+    Ok(())
+}
+
+/// Stamp every active credential of the given kind on the entity as
+/// config-managed. Used for Password and SharedKey where the shared identity
+/// service creates the row without a `managed_by` opinion.
+async fn stamp_managed_credentials(
+    pool: &PgPool,
+    entity_id: Uuid,
+    kind: CredentialKind,
+) -> Result<()> {
+    sqlx::query(
+        "UPDATE credentials SET managed_by = $3
+         WHERE entity_id = $1 AND kind = $2 AND status = 'active'",
+    )
+    .bind(entity_id)
+    .bind(kind)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to stamp bootstrap credential on entity {entity_id}"))?;
+    Ok(())
+}
+
+/// Provision an unscoped access token from operator-supplied material. Parses
+/// the full `atom_<id>_<secret>` string (same format `make_api_key` emits),
+/// then inserts the credential row directly — no ceiling, no expiry. Idempotent
+/// on the credential id.
+async fn ensure_bootstrap_access_token(
+    pool: &PgPool,
+    signing_keys: &SigningKeyConfig,
+    entity: &BootstrapEntity,
+    token: &str,
+    name: &str,
+    description: &Option<String>,
+) -> Result<()> {
+    let name = name.trim();
+    if name.is_empty() {
+        bail!(
+            "bootstrap access token for entity {} has an empty name",
+            entity.id
+        );
+    }
+    let (cred_id, secret_bytes) = crate::auth::parse_api_key(token.trim()).ok_or_else(|| {
+        anyhow!(
+            "bootstrap access token for entity {} is not a valid atom_<id>_<secret> string",
+            entity.id
+        )
+    })?;
+
+    // Skip if the credential row is already present — bootstrap is idempotent.
+    let exists: bool =
+        sqlx::query_scalar("SELECT EXISTS (SELECT 1 FROM credentials WHERE id = $1)")
+            .bind(cred_id)
+            .fetch_one(pool)
+            .await
+            .with_context(|| {
+                format!("failed to look up bootstrap access token credential {cred_id}")
+            })?;
+    if exists {
+        // Ensure the marker sticks even if the row was created by an earlier
+        // bootstrap run against an older Atom without the `managed_by` column.
+        sqlx::query("UPDATE credentials SET managed_by = $2 WHERE id = $1")
+            .bind(cred_id)
+            .bind(MANAGED_BY_CONFIG)
+            .execute(pool)
+            .await
+            .with_context(|| {
+                format!("failed to stamp existing bootstrap access token {cred_id}")
+            })?;
+        tracing::info!(entity_id = %entity.id, credential_id = %cred_id, "bootstrap: access token already present, skipped");
+        return Ok(());
+    }
+
+    // Verifier layout mirrors `identity::access_tokens::create_access_token`:
+    // keyed HMAC-SHA256 under the deployment KEK when present, argon2 fallback
+    // otherwise. Same lookup semantics as API-minted tokens.
+    let (secret_hash, secret_lookup_hash) = match signing_keys.key_encryption_key.as_ref() {
+        Some(kek) => (
+            None::<String>,
+            Some(crate::crypto::hmac_sha256(kek.expose(), &secret_bytes)),
+        ),
+        None => (
+            Some(
+                identity::service::hash_secret(&secret_bytes)
+                    .map_err(|e| anyhow!("bootstrap access token hash for {}: {e}", entity.id))?,
+            ),
+            None,
+        ),
+    };
+    let identifier = token.trim().chars().take(13).collect::<String>();
+    let metadata = serde_json::json!({ "name": name, "description": description });
+
+    sqlx::query(
+        r#"INSERT INTO credentials
+             (id, entity_id, kind, identifier, secret_hash, secret_lookup_hash,
+              scoped, expires_at, metadata, managed_by)
+           VALUES ($1, $2, $3, $4, $5, $6, false, NULL, $7, $8)"#,
+    )
+    .bind(cred_id)
+    .bind(entity.id)
+    .bind(CredentialKind::AccessToken)
+    .bind(identifier)
+    .bind(secret_hash)
+    .bind(secret_lookup_hash)
+    .bind(metadata)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap access token {cred_id}"))?;
+
+    tracing::info!(entity_id = %entity.id, credential_id = %cred_id, "bootstrap: access token credential created");
+    Ok(())
+}
+
+async fn ensure_group(pool: &PgPool, group: &BootstrapGroup) -> Result<()> {
+    let attributes = group
+        .attributes
+        .clone()
+        .unwrap_or_else(|| serde_json::json!({}));
+
+    let result = sqlx::query(
+        r#"INSERT INTO principal_groups (id, name, tenant_id, description, attributes)
+           VALUES ($1, $2, $3, $4, $5)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(group.id)
+    .bind(&group.name)
+    .bind(group.tenant_id)
+    .bind(&group.description)
+    .bind(attributes)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap group {}", group.id))?;
+    stamp_managed_by_config(pool, "principal_groups", group.id).await?;
+    log_upsert(result.rows_affected(), "group", group.id);
+
+    for entity_id in &group.members {
+        sqlx::query(
+            r#"INSERT INTO principal_group_members (group_id, entity_id)
+               VALUES ($1, $2)
+               ON CONFLICT DO NOTHING"#,
+        )
+        .bind(group.id)
+        .bind(entity_id)
+        .execute(pool)
+        .await
+        .with_context(|| {
+            format!(
+                "failed to add entity {entity_id} to bootstrap group {}",
+                group.id
+            )
+        })?;
+    }
+    Ok(())
+}
+
+async fn ensure_resource(pool: &PgPool, resource: &BootstrapResource) -> Result<()> {
+    let alias = validate_alias_opt(resource.alias.clone())
+        .map_err(|e| anyhow!("bootstrap resource {}: {e}", resource.id))?;
+    let attributes = resource
+        .attributes
+        .clone()
+        .unwrap_or_else(|| serde_json::json!({}));
+
+    let result = sqlx::query(
+        r#"INSERT INTO resources (id, kind, name, alias, tenant_id, owner_id, attributes)
+           VALUES ($1, $2, $3, $4, $5, $6, $7)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(resource.id)
+    .bind(&resource.kind)
+    .bind(&resource.name)
+    .bind(alias)
+    .bind(resource.tenant_id)
+    .bind(resource.owner_id)
+    .bind(attributes)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap resource {}", resource.id))?;
+    stamp_managed_by_config(pool, "resources", resource.id).await?;
+    log_upsert(result.rows_affected(), "resource", resource.id);
+    Ok(())
+}
+
+/// Insert the object group row only. Membership and hierarchy are applied in a
+/// second pass ([`ensure_object_group_links`]) so a parent declared later in the
+/// file still resolves.
+async fn ensure_object_group(pool: &PgPool, group: &BootstrapObjectGroup) -> Result<()> {
+    let attributes = group
+        .attributes
+        .clone()
+        .unwrap_or_else(|| serde_json::json!({}));
+
+    let result = sqlx::query(
+        r#"INSERT INTO object_groups (id, name, tenant_id, description, attributes)
+           VALUES ($1, $2, $3, $4, $5)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(group.id)
+    .bind(&group.name)
+    .bind(group.tenant_id)
+    .bind(&group.description)
+    .bind(attributes)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap object group {}", group.id))?;
+    stamp_managed_by_config(pool, "object_groups", group.id).await?;
+    log_upsert(result.rows_affected(), "object group", group.id);
+    Ok(())
+}
+
+/// Apply an object group's parent link and entity/resource membership. An entity
+/// or resource belongs to at most one object group, so membership rows conflict
+/// on the member id and are left untouched if already present.
+async fn ensure_object_group_links(pool: &PgPool, group: &BootstrapObjectGroup) -> Result<()> {
+    if let Some(parent_id) = group.parent {
+        sqlx::query(
+            r#"INSERT INTO object_group_hierarchy (parent_id, child_id, tenant_id)
+               VALUES ($1, $2, $3)
+               ON CONFLICT (child_id) DO NOTHING"#,
+        )
+        .bind(parent_id)
+        .bind(group.id)
+        .bind(group.tenant_id)
+        .execute(pool)
+        .await
+        .with_context(|| {
+            format!(
+                "failed to link object group {} under parent {parent_id}",
+                group.id
+            )
+        })?;
+    }
+
+    for entity_id in &group.entities {
+        sqlx::query(
+            r#"INSERT INTO object_group_entities (group_id, entity_id, tenant_id)
+               VALUES ($1, $2, $3)
+               ON CONFLICT (entity_id) DO NOTHING"#,
+        )
+        .bind(group.id)
+        .bind(entity_id)
+        .bind(group.tenant_id)
+        .execute(pool)
+        .await
+        .with_context(|| {
+            format!(
+                "failed to add entity {entity_id} to object group {}",
+                group.id
+            )
+        })?;
+    }
+
+    for resource_id in &group.resources {
+        sqlx::query(
+            r#"INSERT INTO object_group_resources (group_id, resource_id, tenant_id)
+               VALUES ($1, $2, $3)
+               ON CONFLICT (resource_id) DO NOTHING"#,
+        )
+        .bind(group.id)
+        .bind(resource_id)
+        .bind(group.tenant_id)
+        .execute(pool)
+        .await
+        .with_context(|| {
+            format!(
+                "failed to add resource {resource_id} to object group {}",
+                group.id
+            )
+        })?;
+    }
+    Ok(())
+}
+
+async fn ensure_permission_block(pool: &PgPool, block: &BootstrapPermissionBlock) -> Result<()> {
+    let conditions = block
+        .conditions
+        .clone()
+        .unwrap_or_else(|| serde_json::json!({}));
+    let scope = &block.scope;
+
+    let result = sqlx::query(
+        r#"INSERT INTO permission_blocks
+             (id, tenant_id, scope_mode, object_kind, object_type, object_id, group_id, effect, conditions)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(block.id)
+    .bind(scope.tenant_id)
+    .bind(scope.mode.as_str())
+    .bind(&scope.object_kind)
+    .bind(&scope.object_type)
+    .bind(scope.object_id)
+    .bind(scope.group_id)
+    .bind(&block.effect)
+    .bind(conditions)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap permission block {}", block.id))?;
+    stamp_managed_by_config(pool, "permission_blocks", block.id).await?;
+    log_upsert(result.rows_affected(), "permission block", block.id);
+
+    for action_name in &block.actions {
+        let action_id: Uuid = sqlx::query_scalar("SELECT id FROM actions WHERE name = $1")
+            .bind(action_name)
+            .fetch_optional(pool)
+            .await
+            .with_context(|| format!("failed to resolve action {action_name}"))?
+            .ok_or_else(|| {
+                anyhow!(
+                    "permission block {}: unknown action {action_name}",
+                    block.id
+                )
+            })?;
+        sqlx::query(
+            r#"INSERT INTO permission_block_actions (permission_block_id, action_id)
+               VALUES ($1, $2)
+               ON CONFLICT DO NOTHING"#,
+        )
+        .bind(block.id)
+        .bind(action_id)
+        .execute(pool)
+        .await
+        .with_context(|| {
+            format!(
+                "failed to attach action {action_name} to permission block {}",
+                block.id
+            )
+        })?;
+    }
+    Ok(())
+}
+
+async fn ensure_role(pool: &PgPool, role: &BootstrapRole) -> Result<()> {
+    let result = sqlx::query(
+        r#"INSERT INTO roles (id, name, tenant_id, description)
+           VALUES ($1, $2, $3, $4)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(role.id)
+    .bind(&role.name)
+    .bind(role.tenant_id)
+    .bind(&role.description)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap role {}", role.id))?;
+    stamp_managed_by_config(pool, "roles", role.id).await?;
+    log_upsert(result.rows_affected(), "role", role.id);
+
+    for block_id in &role.permission_blocks {
+        sqlx::query(
+            r#"INSERT INTO role_permission_blocks (role_id, permission_block_id)
+               VALUES ($1, $2)
+               ON CONFLICT DO NOTHING"#,
+        )
+        .bind(role.id)
+        .bind(block_id)
+        .execute(pool)
+        .await
+        .with_context(|| {
+            format!(
+                "failed to link permission block {block_id} to role {}",
+                role.id
+            )
+        })?;
+    }
+    Ok(())
+}
+
+async fn ensure_role_assignment(pool: &PgPool, assignment: &BootstrapRoleAssignment) -> Result<()> {
+    let result = sqlx::query(
+        r#"INSERT INTO role_assignments (id, tenant_id, subject_kind, subject_id, role_id)
+           VALUES ($1, $2, $3, $4, $5)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(assignment.id)
+    .bind(assignment.tenant_id)
+    .bind(&assignment.subject.kind)
+    .bind(assignment.subject.id)
+    .bind(assignment.role_id)
+    .execute(pool)
+    .await
+    .with_context(|| {
+        format!(
+            "failed to insert bootstrap role assignment {}",
+            assignment.id
+        )
+    })?;
+    stamp_managed_by_config(pool, "role_assignments", assignment.id).await?;
+    log_upsert(result.rows_affected(), "role assignment", assignment.id);
+    Ok(())
+}
+
+/// Upsert a capability by name. The row is stamped `managed_by='config'` so
+/// mutation endpoints (`update_capability`, `delete_capability`) refuse to
+/// touch it out of band. Existing description is overwritten by config —
+/// config is authoritative for anything it declares.
+async fn ensure_capability(pool: &PgPool, capability: &BootstrapCapability) -> Result<()> {
+    let name = capability.name.trim().to_string();
+    let action_id: Uuid = sqlx::query_scalar(
+        r#"INSERT INTO actions (name, description, managed_by)
+           VALUES ($1, $2, $3)
+           ON CONFLICT (name) DO UPDATE
+               SET description = EXCLUDED.description,
+                   managed_by  = $3,
+                   updated_at  = now()
+           RETURNING id"#,
+    )
+    .bind(&name)
+    .bind(&capability.description)
+    .bind(MANAGED_BY_CONFIG)
+    .fetch_one(pool)
+    .await
+    .with_context(|| format!("failed to upsert bootstrap capability {name}"))?;
+    tracing::info!(action = %name, id = %action_id, "bootstrap: capability upserted");
+
+    for app in &capability.applicability {
+        ensure_capability_applicability(pool, action_id, &name, app).await?;
+    }
+    Ok(())
+}
+
+async fn ensure_capability_applicability(
+    pool: &PgPool,
+    action_id: Uuid,
+    action_name: &str,
+    app: &BootstrapCapabilityApplicability,
+) -> Result<()> {
+    // Two-step upsert: the unique index on this table is functional
+    // (`COALESCE(object_type, '')`), which makes ON CONFLICT target awkward.
+    // Insert-then-update is simpler and equally atomic per row.
+    sqlx::query(
+        r#"INSERT INTO action_applicability (action_id, object_kind, object_type, managed_by)
+           VALUES ($1, $2, $3, $4)
+           ON CONFLICT DO NOTHING"#,
+    )
+    .bind(action_id)
+    .bind(app.object_kind.as_str())
+    .bind(&app.object_type)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| {
+        format!("failed to insert bootstrap applicability for capability {action_name}")
+    })?;
+
+    sqlx::query(
+        r#"UPDATE action_applicability
+              SET managed_by = $4
+            WHERE action_id = $1
+              AND object_kind = $2
+              AND object_type IS NOT DISTINCT FROM $3"#,
+    )
+    .bind(action_id)
+    .bind(app.object_kind.as_str())
+    .bind(&app.object_type)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| {
+        format!("failed to stamp bootstrap applicability for capability {action_name}")
+    })?;
+    Ok(())
+}
+
+async fn ensure_action_assignment_rule(
+    pool: &PgPool,
+    rule: &BootstrapActionAssignmentRule,
+) -> Result<()> {
+    let action = rule.action_name.trim().to_string();
+
+    // Guardrails reference actions by name — refuse to apply a rule whose
+    // action doesn't exist, otherwise the DB would happily store a permanently
+    // dead rule.
+    let action_exists: bool =
+        sqlx::query_scalar("SELECT EXISTS (SELECT 1 FROM actions WHERE name = $1)")
+            .bind(&action)
+            .fetch_one(pool)
+            .await
+            .with_context(|| {
+                format!("failed to look up action for bootstrap assignment rule {action}")
+            })?;
+    if !action_exists {
+        bail!(
+            "bootstrap action_assignment_rule references unknown action {action}; \
+             declare the capability earlier in the file or via migration"
+        );
+    }
+
+    sqlx::query(
+        r#"INSERT INTO action_assignment_rules
+               (tenant_id, entity_kind, action_name, object_kind, object_type,
+                decision, is_absolute, managed_by)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+           ON CONFLICT DO NOTHING"#,
+    )
+    .bind(rule.tenant_id)
+    .bind(&rule.entity_kind)
+    .bind(&action)
+    .bind(rule.object_kind.as_str())
+    .bind(&rule.object_type)
+    .bind(rule.decision)
+    .bind(rule.is_absolute)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap assignment rule for action {action}"))?;
+
+    // Stamp `managed_by` even if the row already existed (e.g. carried over
+    // from a fresh-db seed) so the API guard fires on subsequent mutations.
+    sqlx::query(
+        r#"UPDATE action_assignment_rules
+              SET managed_by = $7
+            WHERE tenant_id IS NOT DISTINCT FROM $1
+              AND entity_kind = $2
+              AND action_name = $3
+              AND object_kind = $4
+              AND object_type IS NOT DISTINCT FROM $5
+              AND decision = $6"#,
+    )
+    .bind(rule.tenant_id)
+    .bind(&rule.entity_kind)
+    .bind(&action)
+    .bind(rule.object_kind.as_str())
+    .bind(&rule.object_type)
+    .bind(rule.decision)
+    .bind(MANAGED_BY_CONFIG)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to stamp bootstrap assignment rule for action {action}"))?;
+    tracing::info!(action = %action, "bootstrap: assignment rule upserted");
+    Ok(())
+}
+
+async fn ensure_direct_policy(pool: &PgPool, policy: &BootstrapDirectPolicy) -> Result<()> {
+    let result = sqlx::query(
+        r#"INSERT INTO direct_policies (id, tenant_id, subject_kind, subject_id, permission_block_id)
+           VALUES ($1, $2, $3, $4, $5)
+           ON CONFLICT (id) DO NOTHING"#,
+    )
+    .bind(policy.id)
+    .bind(policy.tenant_id)
+    .bind(&policy.subject.kind)
+    .bind(policy.subject.id)
+    .bind(policy.permission_block_id)
+    .execute(pool)
+    .await
+    .with_context(|| format!("failed to insert bootstrap direct policy {}", policy.id))?;
+    stamp_managed_by_config(pool, "direct_policies", policy.id).await?;
+    log_upsert(result.rows_affected(), "direct policy", policy.id);
+    Ok(())
+}
+
+/// Stamp `managed_by='config'` on a bootstrap-touched row of a known RBAC
+/// table. Called from `ensure_*` after the row's INSERT so both newly-created
+/// rows and rows that already existed (e.g. from the initial migration) end
+/// up flagged. The table name is closed over a static match, not
+/// interpolated, so a caller cannot inject arbitrary SQL.
+async fn stamp_managed_by_config(pool: &PgPool, table: &'static str, id: Uuid) -> Result<()> {
+    let sql = match table {
+        "tenants" => "UPDATE tenants SET managed_by = 'config' WHERE id = $1",
+        "resources" => "UPDATE resources SET managed_by = 'config' WHERE id = $1",
+        "principal_groups" => "UPDATE principal_groups SET managed_by = 'config' WHERE id = $1",
+        "object_groups" => "UPDATE object_groups SET managed_by = 'config' WHERE id = $1",
+        "roles" => "UPDATE roles SET managed_by = 'config' WHERE id = $1",
+        "permission_blocks" => "UPDATE permission_blocks SET managed_by = 'config' WHERE id = $1",
+        "role_assignments" => "UPDATE role_assignments SET managed_by = 'config' WHERE id = $1",
+        "direct_policies" => "UPDATE direct_policies SET managed_by = 'config' WHERE id = $1",
+        _ => bail!("unknown managed_by table {table}"),
+    };
+    sqlx::query(sql)
+        .bind(id)
+        .execute(pool)
+        .await
+        .with_context(|| format!("failed to stamp bootstrap {table} {id}"))?;
+    Ok(())
+}
+
+async fn active_credential_exists(
+    pool: &PgPool,
+    entity_id: Uuid,
+    kind: CredentialKind,
+) -> Result<bool> {
+    let count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM credentials WHERE entity_id = $1 AND kind = $2 AND status = 'active'",
+    )
+    .bind(entity_id)
+    .bind(kind)
+    .fetch_one(pool)
+    .await
+    .context("failed to check existing bootstrap credential")?;
+    Ok(count > 0)
+}
+
+fn log_upsert(rows_affected: u64, label: &str, id: Uuid) {
+    if rows_affected == 0 {
+        tracing::info!(id = %id, "bootstrap: {label} already present, skipped");
+    } else {
+        tracing::info!(id = %id, "bootstrap: {label} created");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_full_rbac_graph() {
+        let yaml = r#"
+tenants:
+  - id: 33333333-3333-3333-3333-333333333333
+    name: factory
+    alias: factory
+    tags: [demo]
+    attributes: { region: eu }
+
+entities:
+  - id: 22222222-2222-2222-2222-222222222222
+    kind: device
+    name: gateway-01
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    credentials:
+      - kind: shared_key
+        key: a-strong-device-secret
+
+resources:
+  - id: 99999999-9999-9999-9999-999999999999
+    kind: channel
+    name: temperature
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    owner_id: 22222222-2222-2222-2222-222222222222
+
+groups:
+  - id: 77777777-7777-7777-7777-777777777777
+    name: publishers
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    members:
+      - 22222222-2222-2222-2222-222222222222
+
+object_groups:
+  - id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+    name: production-channels
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    resources:
+      - 99999999-9999-9999-9999-999999999999
+
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: object_type
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      object_kind: resource
+      object_type: resource:channel
+    actions: [publish, subscribe]
+    effect: allow
+  - id: bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
+    scope:
+      mode: group_direct_objects
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      group_id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+      object_kind: resource
+      object_type: resource:channel
+    actions: [read]
+    effect: allow
+
+roles:
+  - id: 55555555-5555-5555-5555-555555555555
+    name: publisher
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    permission_blocks: [44444444-4444-4444-4444-444444444444]
+
+role_assignments:
+  - id: 66666666-6666-6666-6666-666666666666
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    subject: { kind: entity, id: 22222222-2222-2222-2222-222222222222 }
+    role_id: 55555555-5555-5555-5555-555555555555
+
+direct_policies:
+  - id: 88888888-8888-8888-8888-888888888888
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    subject: { kind: group, id: 77777777-7777-7777-7777-777777777777 }
+    permission_block_id: 44444444-4444-4444-4444-444444444444
+"#;
+        let cfg = parse(yaml).expect("parse");
+        assert_eq!(cfg.tenants.len(), 1);
+        assert_eq!(cfg.entities.len(), 1);
+        assert_eq!(cfg.resources[0].kind, "channel");
+        assert_eq!(cfg.groups[0].members.len(), 1);
+        assert_eq!(cfg.object_groups[0].resources.len(), 1);
+        assert_eq!(cfg.permission_blocks[0].scope.mode, ScopeMode::ObjectType);
+        assert_eq!(cfg.permission_blocks[0].effect, Effect::Allow);
+        assert_eq!(
+            cfg.permission_blocks[1].scope.mode,
+            ScopeMode::GroupDirectObjects
+        );
+        assert!(cfg.permission_blocks[1].scope.group_id.is_some());
+        assert_eq!(cfg.roles[0].permission_blocks.len(), 1);
+        assert_eq!(cfg.role_assignments[0].subject.kind, SubjectKind::Entity);
+        assert_eq!(cfg.direct_policies[0].subject.kind, SubjectKind::Group);
+    }
+
+    #[test]
+    fn parses_entities_with_credentials() {
+        let yaml = r#"
+entities:
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    attributes:
+      role: admin
+    credentials:
+      - kind: password
+        secret: change-me-please
+  - id: 11111111-1111-1111-1111-111111111111
+    kind: service
+    name: ingest
+    alias: ingest-svc
+    credentials:
+      - kind: shared_key
+        key: super-secret-key
+        description: ingest pipeline
+"#;
+        let cfg = parse(yaml).expect("parse");
+        assert_eq!(cfg.entities.len(), 2);
+
+        let admin = &cfg.entities[0];
+        assert_eq!(admin.kind, EntityKind::Human);
+        assert_eq!(admin.status, EntityStatus::Active);
+        assert_eq!(
+            admin.credentials,
+            vec![BootstrapCredential::Password {
+                secret: "change-me-please".to_string()
+            }]
+        );
+
+        let svc = &cfg.entities[1];
+        assert_eq!(svc.kind, EntityKind::Service);
+        assert_eq!(svc.alias.as_deref(), Some("ingest-svc"));
+        assert_eq!(
+            svc.credentials,
+            vec![BootstrapCredential::SharedKey {
+                key: "super-secret-key".to_string(),
+                description: Some("ingest pipeline".to_string()),
+            }]
+        );
+    }
+
+    #[test]
+    fn empty_document_is_valid_and_empty() {
+        let cfg = parse("{}").expect("parse");
+        assert!(cfg.entities.is_empty());
+        assert!(cfg.tenants.is_empty());
+    }
+
+    #[test]
+    fn unknown_fields_are_rejected() {
+        let yaml = r#"
+entities:
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    typo_field: oops
+"#;
+        assert!(parse(yaml).is_err(), "unknown field should be rejected");
+    }
+
+    #[test]
+    fn duplicate_entity_ids_are_rejected() {
+        let yaml = r#"
+entities:
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin-two
+"#;
+        let err = parse(yaml).expect_err("duplicate ids");
+        assert!(err.to_string().contains("duplicate bootstrap entity id"));
+    }
+
+    #[test]
+    fn shared_key_on_human_is_rejected() {
+        let yaml = r#"
+entities:
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    credentials:
+      - kind: shared_key
+        key: nope
+"#;
+        let err = parse(yaml).expect_err("human shared key");
+        assert!(err.to_string().contains("shared keys are only valid"));
+    }
+
+    #[test]
+    fn multiple_passwords_per_entity_are_rejected() {
+        let yaml = r#"
+entities:
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    credentials:
+      - kind: password
+        secret: one-secret
+      - kind: password
+        secret: two-secret
+"#;
+        let err = parse(yaml).expect_err("two passwords");
+        assert!(err.to_string().contains("more than one password"));
+    }
+
+    #[test]
+    fn non_object_attributes_are_rejected() {
+        let yaml = r#"
+entities:
+  - id: 00000000-0000-0000-0000-000000000001
+    kind: human
+    name: admin
+    attributes: "not-an-object"
+"#;
+        let err = parse(yaml).expect_err("scalar attributes");
+        assert!(err.to_string().contains("must be a JSON object"));
+    }
+
+    #[test]
+    fn platform_scope_rejects_tenant_id() {
+        let yaml = r#"
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: platform
+      tenant_id: 33333333-3333-3333-3333-333333333333
+    actions: [read]
+"#;
+        let err = parse(yaml).expect_err("platform with tenant");
+        assert!(err.to_string().contains("platform scope takes no"));
+    }
+
+    #[test]
+    fn object_type_scope_requires_object_kind_and_type() {
+        let yaml = r#"
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: object_type
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      object_type: resource:channel
+    actions: [read]
+"#;
+        let err = parse(yaml).expect_err("missing object_kind");
+        assert!(err.to_string().contains("object_type scope requires"));
+    }
+
+    #[test]
+    fn duplicate_tenant_ids_are_rejected() {
+        let yaml = r#"
+tenants:
+  - id: 33333333-3333-3333-3333-333333333333
+    name: one
+  - id: 33333333-3333-3333-3333-333333333333
+    name: two
+"#;
+        let err = parse(yaml).expect_err("duplicate tenant ids");
+        assert!(err.to_string().contains("duplicate bootstrap tenant id"));
+    }
+
+    #[test]
+    fn group_scope_requires_group_id() {
+        let yaml = r#"
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: group_direct_objects
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      object_kind: resource
+    actions: [read]
+"#;
+        let err = parse(yaml).expect_err("missing group_id");
+        assert!(err.to_string().contains("require tenant_id and group_id"));
+    }
+
+    #[test]
+    fn group_object_scope_requires_entity_or_resource_kind() {
+        let yaml = r#"
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: group_direct_objects
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      group_id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+      object_kind: tenant
+    actions: [read]
+"#;
+        let err = parse(yaml).expect_err("bad object_kind");
+        assert!(err
+            .to_string()
+            .contains("object_kind of 'entity' or 'resource'"));
+    }
+
+    #[test]
+    fn group_object_scope_requires_object_type() {
+        let yaml = r#"
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: group_direct_objects
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      group_id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+      object_kind: resource
+    actions: [read]
+"#;
+        let err = parse(yaml).expect_err("missing object_type");
+        assert!(err.to_string().contains("require object_type"));
+    }
+
+    #[test]
+    fn group_id_rejected_on_non_group_scope() {
+        let yaml = r#"
+permission_blocks:
+  - id: 44444444-4444-4444-4444-444444444444
+    scope:
+      mode: tenant
+      tenant_id: 33333333-3333-3333-3333-333333333333
+      group_id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+    actions: [read]
+"#;
+        let err = parse(yaml).expect_err("group_id on tenant scope");
+        assert!(err
+            .to_string()
+            .contains("only group_* scopes take a group_id"));
+    }
+
+    #[test]
+    fn object_group_with_members_requires_tenant() {
+        let yaml = r#"
+object_groups:
+  - id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+    name: channels
+    resources:
+      - 99999999-9999-9999-9999-999999999999
+"#;
+        let err = parse(yaml).expect_err("members without tenant");
+        assert!(err.to_string().contains("has members but no tenant_id"));
+    }
+
+    #[test]
+    fn object_group_cannot_be_its_own_parent() {
+        let yaml = r#"
+object_groups:
+  - id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+    name: channels
+    tenant_id: 33333333-3333-3333-3333-333333333333
+    parent: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+"#;
+        let err = parse(yaml).expect_err("self parent");
+        assert!(err.to_string().contains("cannot be its own parent"));
+    }
+
+    #[test]
+    fn resource_requires_kind() {
+        let yaml = r#"
+resources:
+  - id: 99999999-9999-9999-9999-999999999999
+    kind: "  "
+"#;
+        let err = parse(yaml).expect_err("empty kind");
+        assert!(err.to_string().contains("empty kind"));
+    }
+}
diff --git a/src/callout/config.rs b/src/callout/config.rs
new file mode 100644
index 00000000..c03a0aa0
--- /dev/null
+++ b/src/callout/config.rs
@@ -0,0 +1,520 @@
+//! Callout configuration — YAML file + env overrides.
+//!
+//! Loaded once at startup (see `main.rs`). Kept separate from `bootstrap.yaml`
+//! because the two have different lifecycles: bootstrap is one-shot idempotent
+//! seeding, callouts are runtime behavior.
+
+use std::{collections::HashMap, path::Path};
+
+use anyhow::{anyhow, bail, Context, Result};
+use serde::Deserialize;
+
+/// Endpoint id used to cross-reference an endpoint definition from an
+/// operation entry. Just a string internally; a newtype for clarity in APIs.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Deserialize)]
+#[serde(transparent)]
+pub struct EndpointId(pub String);
+
+impl EndpointId {
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Display for EndpointId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum OnError {
+    #[default]
+    Deny,
+    Allow,
+}
+
+impl OnError {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Deny => "deny",
+            Self::Allow => "allow",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "UPPERCASE")]
+pub enum HttpMethod {
+    Post,
+    Get,
+}
+
+impl HttpMethod {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Post => "POST",
+            Self::Get => "GET",
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+pub struct TlsConfig {
+    /// PEM CA bundle used to verify the peer.
+    #[serde(default)]
+    pub ca_path: Option<String>,
+    /// Client cert PEM (mTLS). Must be set together with `client_key_path`.
+    #[serde(default)]
+    pub client_cert_path: Option<String>,
+    /// Client key PEM (mTLS).
+    #[serde(default)]
+    pub client_key_path: Option<String>,
+    /// If true, TLS verification is skipped. Never do this in production; the
+    /// config loader logs a warning when this is set.
+    #[serde(default)]
+    pub insecure_skip_verify: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+#[serde(tag = "transport", rename_all = "lowercase")]
+pub enum TransportConfig {
+    Http(HttpTransportConfig),
+    Grpc(GrpcTransportConfig),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+pub struct HttpTransportConfig {
+    pub url: String,
+    #[serde(default = "default_http_method")]
+    pub method: HttpMethod,
+    #[serde(default)]
+    pub headers: HashMap<String, String>,
+}
+
+fn default_http_method() -> HttpMethod {
+    HttpMethod::Post
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+pub struct GrpcTransportConfig {
+    /// gRPC target, e.g. `https://policy.internal:9443` or `http://policy:9443`.
+    /// The scheme picks TLS on/off; `dns:///` targets are supported as-is.
+    pub address: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+pub struct EndpointConfig {
+    pub id: EndpointId,
+    #[serde(flatten)]
+    pub transport: TransportConfig,
+    #[serde(default = "default_timeout_ms")]
+    pub timeout_ms: u64,
+    #[serde(default)]
+    pub tls: Option<TlsConfig>,
+    #[serde(default)]
+    pub on_error: OnError,
+}
+
+fn default_timeout_ms() -> u64 {
+    500
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SurfaceKind {
+    Graphql,
+    Grpc,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+pub struct OperationConfig {
+    /// Resolver name (GraphQL) or fully-qualified method ("svc/method") (gRPC).
+    pub name: String,
+    pub surface: SurfaceKind,
+    /// Endpoint ids to invoke, in order. All must ALLOW for the operation to
+    /// proceed; the first non-ALLOW aborts.
+    pub endpoints: Vec<EndpointId>,
+    /// Dot-path whitelist of fields to include in the callout payload.
+    /// Paths are rooted at the envelope, e.g. `actor.entity_id`, `args.input.name`.
+    /// If empty, no args/actor fields are forwarded (still: operation, surface,
+    /// time, request_id, extra).
+    #[serde(default)]
+    pub include: Vec<String>,
+    /// Static key/value pairs merged into the payload's `extra` field.
+    #[serde(default)]
+    pub extra: HashMap<String, serde_json::Value>,
+}
+
+/// Root of `callouts.yaml`.
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+pub struct CalloutsFile {
+    #[serde(default)]
+    pub callouts: CalloutsSection,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize)]
+pub struct CalloutsSection {
+    #[serde(default)]
+    pub endpoints: Vec<EndpointConfig>,
+    #[serde(default)]
+    pub operations: Vec<OperationConfig>,
+}
+
+/// Runtime callout configuration: indexed for O(1) lookup by (surface, name).
+#[derive(Debug, Clone, Default)]
+pub struct CalloutsConfig {
+    endpoints: HashMap<EndpointId, EndpointConfig>,
+    graphql_ops: HashMap<String, OperationConfig>,
+    grpc_ops: HashMap<String, OperationConfig>,
+}
+
+impl CalloutsConfig {
+    /// Empty (no-op) config — used when `ATOM_CALLOUTS_FILE` is unset or the
+    /// callouts subsystem is disabled.
+    pub fn empty() -> Self {
+        Self::default()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.graphql_ops.is_empty() && self.grpc_ops.is_empty()
+    }
+
+    pub fn endpoint(&self, id: &EndpointId) -> Option<&EndpointConfig> {
+        self.endpoints.get(id)
+    }
+
+    pub fn endpoints(&self) -> impl Iterator<Item = &EndpointConfig> {
+        self.endpoints.values()
+    }
+
+    /// Look up the operation config for a GraphQL resolver name. Returns
+    /// `None` when the resolver has no callout configured — the common case.
+    pub fn graphql_op(&self, name: &str) -> Option<&OperationConfig> {
+        self.graphql_ops.get(name)
+    }
+
+    pub fn grpc_op(&self, method: &str) -> Option<&OperationConfig> {
+        self.grpc_ops.get(method)
+    }
+
+    /// Build from a parsed file, validating references and env overrides.
+    pub fn build(file: CalloutsFile) -> Result<Self> {
+        let mut endpoints: HashMap<EndpointId, EndpointConfig> = HashMap::new();
+        for ep in file.callouts.endpoints {
+            if ep.timeout_ms == 0 {
+                bail!("callout endpoint {:?} timeout_ms must be > 0", ep.id);
+            }
+            if let TransportConfig::Http(ref h) = ep.transport {
+                if h.url.trim().is_empty() {
+                    bail!("callout endpoint {:?} http url is empty", ep.id);
+                }
+            }
+            if let TransportConfig::Grpc(ref g) = ep.transport {
+                if g.address.trim().is_empty() {
+                    bail!("callout endpoint {:?} grpc address is empty", ep.id);
+                }
+            }
+            if let Some(ref tls) = ep.tls {
+                if tls.insecure_skip_verify {
+                    tracing::warn!(
+                        endpoint = %ep.id,
+                        "callout endpoint has TLS verification disabled; do not use in production"
+                    );
+                }
+                match (tls.client_cert_path.as_ref(), tls.client_key_path.as_ref()) {
+                    (Some(_), None) | (None, Some(_)) => bail!(
+                        "callout endpoint {:?} tls.client_cert_path and tls.client_key_path must both be set or both unset",
+                        ep.id
+                    ),
+                    _ => {}
+                }
+            }
+            let id = ep.id.clone();
+            if endpoints.insert(id.clone(), ep).is_some() {
+                bail!("duplicate callout endpoint id: {id}");
+            }
+        }
+
+        let mut graphql_ops: HashMap<String, OperationConfig> = HashMap::new();
+        let mut grpc_ops: HashMap<String, OperationConfig> = HashMap::new();
+        for op in file.callouts.operations {
+            if op.name.trim().is_empty() {
+                bail!("callout operation with empty name");
+            }
+            if op.endpoints.is_empty() {
+                bail!("callout operation {:?} has no endpoints", op.name);
+            }
+            for ep_id in &op.endpoints {
+                if !endpoints.contains_key(ep_id) {
+                    bail!(
+                        "callout operation {:?} references unknown endpoint {:?}",
+                        op.name,
+                        ep_id
+                    );
+                }
+            }
+            validate_include_paths(&op)?;
+            let target = match op.surface {
+                SurfaceKind::Graphql => &mut graphql_ops,
+                SurfaceKind::Grpc => &mut grpc_ops,
+            };
+            if target.insert(op.name.clone(), op.clone()).is_some() {
+                bail!("duplicate callout operation: {}", op.name);
+            }
+        }
+
+        Ok(Self {
+            endpoints,
+            graphql_ops,
+            grpc_ops,
+        })
+    }
+
+    /// Load `callouts.yaml` from disk, apply env overrides, then build.
+    /// `None` when `ATOM_CALLOUTS_ENABLED=false` or the file is missing/unset.
+    pub async fn load_from_env() -> Result<Self> {
+        if let Ok(v) = std::env::var("ATOM_CALLOUTS_ENABLED") {
+            let enabled = matches!(
+                v.trim().to_ascii_lowercase().as_str(),
+                "1" | "true" | "yes" | "on"
+            );
+            if !enabled {
+                tracing::info!("callouts disabled (ATOM_CALLOUTS_ENABLED=false)");
+                return Ok(Self::empty());
+            }
+        }
+        let path = match std::env::var("ATOM_CALLOUTS_FILE") {
+            Ok(v) if !v.trim().is_empty() => v,
+            _ => {
+                tracing::info!("callouts disabled (ATOM_CALLOUTS_FILE not set)");
+                return Ok(Self::empty());
+            }
+        };
+        let file = load_file(Path::new(&path)).await?;
+        let mut file = file;
+        apply_env_overrides(&mut file)?;
+        let cfg = Self::build(file)?;
+        tracing::info!(
+            endpoints = cfg.endpoints.len(),
+            graphql_ops = cfg.graphql_ops.len(),
+            grpc_ops = cfg.grpc_ops.len(),
+            "callouts configured"
+        );
+        Ok(cfg)
+    }
+}
+
+async fn load_file(path: &Path) -> Result<CalloutsFile> {
+    // tokio::fs so a wedged mount cannot pin a worker thread at startup.
+    let bytes = tokio::fs::read(path)
+        .await
+        .with_context(|| format!("read callouts file {}", path.display()))?;
+    serde_yaml::from_slice::<CalloutsFile>(&bytes)
+        .with_context(|| format!("parse callouts file {}", path.display()))
+}
+
+/// Env overrides: `ATOM_CALLOUT_<UPPER_ID>_URL`, `_ADDRESS`, `_TIMEOUT_MS`.
+/// Non-alphanumeric characters in the endpoint id are replaced with `_` for
+/// the env-var name (so `policy-gate` → `POLICY_GATE`).
+fn apply_env_overrides(file: &mut CalloutsFile) -> Result<()> {
+    for ep in &mut file.callouts.endpoints {
+        let sanitized = ep
+            .id
+            .as_str()
+            .chars()
+            .map(|c| {
+                if c.is_ascii_alphanumeric() {
+                    c.to_ascii_uppercase()
+                } else {
+                    '_'
+                }
+            })
+            .collect::<String>();
+        let prefix = format!("ATOM_CALLOUT_{sanitized}_");
+        if let Ok(v) = std::env::var(format!("{prefix}TIMEOUT_MS")) {
+            ep.timeout_ms = v
+                .parse()
+                .map_err(|e| anyhow!("invalid {prefix}TIMEOUT_MS: {e}"))?;
+        }
+        match &mut ep.transport {
+            TransportConfig::Http(h) => {
+                if let Ok(v) = std::env::var(format!("{prefix}URL")) {
+                    h.url = v;
+                }
+            }
+            TransportConfig::Grpc(g) => {
+                if let Ok(v) = std::env::var(format!("{prefix}ADDRESS")) {
+                    g.address = v;
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+fn validate_include_paths(op: &OperationConfig) -> Result<()> {
+    // Paths are dot-separated identifiers. We keep validation deliberately
+    // shallow — the filter walks only what actually exists at runtime — but
+    // reject obviously-malformed entries so mistakes fail at startup, not
+    // during a callout.
+    for path in &op.include {
+        if path.trim().is_empty() {
+            bail!("callout operation {:?} has an empty include path", op.name);
+        }
+        for segment in path.split('.') {
+            if segment.is_empty() {
+                bail!(
+                    "callout operation {:?} include path {:?} has an empty segment",
+                    op.name,
+                    path
+                );
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_minimal_http_endpoint_and_op() {
+        let yaml = r#"
+callouts:
+  endpoints:
+    - id: policy
+      transport: http
+      url: https://policy.example/authz
+  operations:
+    - name: createEntity
+      surface: graphql
+      endpoints: [policy]
+      include: [actor.entity_id, args.input.name]
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let cfg = CalloutsConfig::build(file).unwrap();
+        assert!(cfg.graphql_op("createEntity").is_some());
+        assert!(cfg.graphql_op("noSuchThing").is_none());
+        let ep = cfg.endpoint(&EndpointId("policy".into())).unwrap();
+        assert_eq!(ep.timeout_ms, 500);
+        assert!(matches!(ep.on_error, OnError::Deny));
+        match &ep.transport {
+            TransportConfig::Http(h) => assert!(matches!(h.method, HttpMethod::Post)),
+            _ => panic!("expected http transport"),
+        }
+    }
+
+    #[test]
+    fn rejects_operation_referencing_unknown_endpoint() {
+        let yaml = r#"
+callouts:
+  operations:
+    - name: createEntity
+      surface: graphql
+      endpoints: [nope]
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let err = CalloutsConfig::build(file).unwrap_err();
+        assert!(err.to_string().contains("unknown endpoint"));
+    }
+
+    #[test]
+    fn rejects_duplicate_endpoint_id() {
+        let yaml = r#"
+callouts:
+  endpoints:
+    - id: policy
+      transport: http
+      url: https://a
+    - id: policy
+      transport: http
+      url: https://b
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let err = CalloutsConfig::build(file).unwrap_err();
+        assert!(err.to_string().contains("duplicate"));
+    }
+
+    #[test]
+    fn rejects_http_with_empty_url() {
+        let yaml = r#"
+callouts:
+  endpoints:
+    - id: policy
+      transport: http
+      url: ""
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let err = CalloutsConfig::build(file).unwrap_err();
+        assert!(err.to_string().contains("url is empty"));
+    }
+
+    #[test]
+    fn rejects_partial_mtls_config() {
+        let yaml = r#"
+callouts:
+  endpoints:
+    - id: policy
+      transport: http
+      url: https://a
+      tls:
+        client_cert_path: /a/cert.pem
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let err = CalloutsConfig::build(file).unwrap_err();
+        assert!(err.to_string().contains("client_cert_path"));
+    }
+
+    #[test]
+    fn rejects_include_path_with_empty_segment() {
+        let yaml = r#"
+callouts:
+  endpoints:
+    - id: policy
+      transport: http
+      url: https://a
+  operations:
+    - name: createEntity
+      surface: graphql
+      endpoints: [policy]
+      include: ["actor..entity_id"]
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let err = CalloutsConfig::build(file).unwrap_err();
+        assert!(err.to_string().contains("empty segment"));
+    }
+
+    #[test]
+    fn parses_grpc_transport_and_get_method() {
+        let yaml = r#"
+callouts:
+  endpoints:
+    - id: policy-grpc
+      transport: grpc
+      address: https://policy.internal:9443
+      timeout_ms: 250
+    - id: policy-get
+      transport: http
+      url: https://policy.example/authz
+      method: GET
+      on_error: allow
+"#;
+        let file: CalloutsFile = serde_yaml::from_str(yaml).unwrap();
+        let cfg = CalloutsConfig::build(file).unwrap();
+        let grpc = cfg.endpoint(&EndpointId("policy-grpc".into())).unwrap();
+        assert_eq!(grpc.timeout_ms, 250);
+        match &grpc.transport {
+            TransportConfig::Grpc(g) => assert_eq!(g.address, "https://policy.internal:9443"),
+            _ => panic!("expected grpc transport"),
+        }
+        let get = cfg.endpoint(&EndpointId("policy-get".into())).unwrap();
+        match &get.transport {
+            TransportConfig::Http(h) => assert!(matches!(h.method, HttpMethod::Get)),
+            _ => panic!("expected http transport"),
+        }
+        assert!(matches!(get.on_error, OnError::Allow));
+    }
+}
diff --git a/src/callout/envelope.rs b/src/callout/envelope.rs
new file mode 100644
index 00000000..9d01a0b5
--- /dev/null
+++ b/src/callout/envelope.rs
@@ -0,0 +1,398 @@
+//! Wire-shape envelope shared by HTTP and gRPC transports.
+//!
+//! Field selection ("include") walks the envelope JSON with dot-paths rooted
+//! at `actor.*`, `args.*`, `extra.*`, etc., and produces a new JSON tree
+//! containing only the whitelisted subtrees. A hard denylist strips keys named
+//! `secret`, `password`, or `key` at any depth, as a safety net independent of
+//! the config file.
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+use uuid::Uuid;
+
+use super::config::OperationConfig;
+use super::Surface;
+
+/// Hard denylist — these key names are stripped from the payload after
+/// include-filtering, regardless of whether the config asked for them. Applied
+/// at any depth (deep matching), so a nested `credentials.secret` is also
+/// removed. Match is case-insensitive.
+///
+/// Deliberately conservative: the goal is "impossible to accidentally leak the
+/// obvious secret fields", not "a general redaction policy".
+pub const DENYLIST_KEYS: &[&str] = &["secret", "password", "key"];
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Actor {
+    #[serde(skip_serializing_if = "String::is_empty", default)]
+    pub entity_id: String,
+    #[serde(skip_serializing_if = "String::is_empty", default)]
+    pub tenant_id: String,
+    /// "session" for JWT/cookie auth, "access_token" for API-key auth, "" otherwise.
+    #[serde(skip_serializing_if = "String::is_empty", default)]
+    pub scope: String,
+    #[serde(skip_serializing_if = "String::is_empty", default)]
+    pub credential_id: String,
+    #[serde(skip_serializing_if = "String::is_empty", default)]
+    pub source_ip: String,
+    #[serde(skip_serializing_if = "String::is_empty", default)]
+    pub user_agent: String,
+}
+
+impl Actor {
+    pub fn from_auth(auth: &crate::auth::AuthContext) -> Self {
+        Self {
+            entity_id: auth.entity_id.to_string(),
+            tenant_id: auth.tenant_id.map(|t| t.to_string()).unwrap_or_default(),
+            scope: if auth.credential_id.is_some() {
+                "access_token".to_string()
+            } else if auth.session_id.is_some() {
+                "session".to_string()
+            } else {
+                String::new()
+            },
+            credential_id: auth
+                .credential_id
+                .map(|c| c.to_string())
+                .unwrap_or_default(),
+            source_ip: String::new(),
+            user_agent: String::new(),
+        }
+    }
+}
+
+/// Canonical callout envelope — the shape sent to HTTP as JSON and translated
+/// to `atom.v1.CalloutRequest` for gRPC.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CalloutRequest {
+    pub operation: String,
+    pub surface: String,
+    pub request_id: String,
+    /// RFC-3339 UTC.
+    pub time: String,
+    pub actor: Actor,
+    /// Filtered args (per operation `include:`).
+    #[serde(default)]
+    pub args: Value,
+    /// Static extras merged from operation config.
+    #[serde(default)]
+    pub extra: Value,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Decision {
+    Allow,
+    Deny,
+}
+
+impl Decision {
+    pub fn is_allow(self) -> bool {
+        matches!(self, Self::Allow)
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CalloutResponse {
+    pub decision: Decision,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub reason: String,
+}
+
+impl CalloutResponse {
+    pub fn allow() -> Self {
+        Self {
+            decision: Decision::Allow,
+            reason: String::new(),
+        }
+    }
+
+    pub fn deny(reason: impl Into<String>) -> Self {
+        Self {
+            decision: Decision::Deny,
+            reason: reason.into(),
+        }
+    }
+}
+
+/// Build the envelope for a given operation invocation.
+///
+/// `raw_args` is the resolver/method args serialized to JSON (an Object).
+/// `actor` is the authenticated caller. The include-list from `op` selects
+/// which of `actor.*` / `args.*` / `extra.*` subtrees are kept.
+pub fn build(
+    op: &OperationConfig,
+    surface: Surface,
+    actor: Actor,
+    raw_args: Value,
+    now: chrono::DateTime<chrono::Utc>,
+) -> CalloutRequest {
+    let extra_val = if op.extra.is_empty() {
+        Value::Null
+    } else {
+        let mut m = Map::new();
+        for (k, v) in &op.extra {
+            m.insert(k.clone(), v.clone());
+        }
+        Value::Object(m)
+    };
+
+    // Build the full envelope, then filter.
+    let full_actor = serde_json::to_value(&actor).unwrap_or(Value::Null);
+    let full = Value::Object({
+        let mut m = Map::new();
+        m.insert("actor".into(), full_actor);
+        m.insert("args".into(), raw_args);
+        m.insert("extra".into(), extra_val);
+        m
+    });
+
+    let filtered = if op.include.is_empty() {
+        // Empty include => omit actor/args entirely. `extra` is always included
+        // (it's a static config-controlled payload).
+        let mut m = Map::new();
+        m.insert("extra".into(), full["extra"].clone());
+        Value::Object(m)
+    } else {
+        // `extra` is a static config-controlled payload — always included,
+        // independent of the whitelist. The whitelist selects from
+        // `actor.*` / `args.*`.
+        let mut selected = select_paths(&full, &op.include);
+        if let Value::Object(m) = &mut selected {
+            m.insert("extra".into(), full["extra"].clone());
+        }
+        selected
+    };
+
+    let redacted = strip_denylisted(filtered);
+
+    // Extract back out into typed fields for the envelope.
+    let (actor_out, args_out, extra_out) = split_envelope(redacted, &actor);
+
+    CalloutRequest {
+        operation: op.name.clone(),
+        surface: surface.as_str().to_string(),
+        request_id: Uuid::new_v4().to_string(),
+        time: now.to_rfc3339(),
+        actor: actor_out,
+        args: args_out,
+        extra: extra_out,
+    }
+}
+
+fn split_envelope(mut v: Value, default_actor: &Actor) -> (Actor, Value, Value) {
+    let actor = v
+        .as_object_mut()
+        .and_then(|m| m.remove("actor"))
+        .and_then(|a| serde_json::from_value::<Actor>(a).ok())
+        .unwrap_or_else(|| {
+            // If the include-list excluded actor entirely, propagate an empty
+            // Actor rather than the un-filtered caller. That mirrors "you get
+            // what you asked for and nothing else."
+            let _ = default_actor;
+            Actor::default()
+        });
+    let args = v
+        .as_object_mut()
+        .and_then(|m| m.remove("args"))
+        .unwrap_or(Value::Null);
+    let extra = v
+        .as_object_mut()
+        .and_then(|m| m.remove("extra"))
+        .unwrap_or(Value::Null);
+    (actor, args, extra)
+}
+
+/// Recursively strip denylisted key names (case-insensitive) at any depth.
+pub fn strip_denylisted(v: Value) -> Value {
+    match v {
+        Value::Object(mut m) => {
+            m.retain(|k, _| {
+                let lower = k.to_ascii_lowercase();
+                !DENYLIST_KEYS.iter().any(|d| *d == lower)
+            });
+            for (_k, v) in m.iter_mut() {
+                let taken = std::mem::replace(v, Value::Null);
+                *v = strip_denylisted(taken);
+            }
+            Value::Object(m)
+        }
+        Value::Array(arr) => Value::Array(arr.into_iter().map(strip_denylisted).collect()),
+        other => other,
+    }
+}
+
+/// Select a subset of `source` matching any of the dot-paths. Missing paths
+/// are silently skipped (they simply don't appear in the output).
+pub fn select_paths(source: &Value, paths: &[String]) -> Value {
+    let mut out = Value::Object(Map::new());
+    for path in paths {
+        let segments: Vec<&str> = path.split('.').collect();
+        if let Some(val) = walk(source, &segments) {
+            insert_at(&mut out, &segments, val.clone());
+        }
+    }
+    out
+}
+
+fn walk<'a>(v: &'a Value, segments: &[&str]) -> Option<&'a Value> {
+    let mut current = v;
+    for seg in segments {
+        match current {
+            Value::Object(m) => {
+                current = m.get(*seg)?;
+            }
+            _ => return None,
+        }
+    }
+    Some(current)
+}
+
+fn insert_at(target: &mut Value, segments: &[&str], value: Value) {
+    if segments.is_empty() {
+        return;
+    }
+    let (last, prefix) = segments.split_last().expect("non-empty");
+    let mut current = target;
+    for seg in prefix {
+        let obj = current
+            .as_object_mut()
+            .expect("select target must be object");
+        let entry = obj
+            .entry((*seg).to_string())
+            .or_insert_with(|| Value::Object(Map::new()));
+        if !entry.is_object() {
+            // A conflict between a leaf and a deeper path — the deeper path
+            // wins (overwrites the earlier leaf). Keeps the include list
+            // order-independent for realistic inputs.
+            *entry = Value::Object(Map::new());
+        }
+        current = entry;
+    }
+    if let Some(obj) = current.as_object_mut() {
+        obj.insert((*last).to_string(), value);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::callout::config::{OperationConfig, SurfaceKind};
+    use serde_json::json;
+
+    fn op(include: &[&str], extra: serde_json::Value) -> OperationConfig {
+        let extra_map = extra
+            .as_object()
+            .map(|m| m.clone().into_iter().collect())
+            .unwrap_or_default();
+        OperationConfig {
+            name: "createEntity".to_string(),
+            surface: SurfaceKind::Graphql,
+            endpoints: vec![],
+            include: include.iter().map(|s| s.to_string()).collect(),
+            extra: extra_map,
+        }
+    }
+
+    #[test]
+    fn empty_include_omits_actor_and_args() {
+        let cfg = op(&[], json!({}));
+        let actor = Actor {
+            entity_id: "abc".into(),
+            ..Default::default()
+        };
+        let req = build(
+            &cfg,
+            Surface::GraphQL,
+            actor,
+            json!({"input": {"name": "x"}}),
+            chrono::Utc::now(),
+        );
+        assert_eq!(req.actor, Actor::default());
+        assert!(req.args.is_null() || req.args.as_object().is_some_and(|m| m.is_empty()));
+    }
+
+    #[test]
+    fn include_selects_subtree_only() {
+        let cfg = op(&["actor.entity_id", "args.input.name"], json!({}));
+        let actor = Actor {
+            entity_id: "abc".into(),
+            tenant_id: "tenant-1".into(),
+            ..Default::default()
+        };
+        let req = build(
+            &cfg,
+            Surface::GraphQL,
+            actor,
+            json!({"input": {"name": "gadget", "kind": "device"}}),
+            chrono::Utc::now(),
+        );
+        assert_eq!(req.actor.entity_id, "abc");
+        // Tenant not in include list.
+        assert!(req.actor.tenant_id.is_empty());
+        assert_eq!(req.args, json!({"input": {"name": "gadget"}}));
+    }
+
+    #[test]
+    fn denylist_strips_secret_at_any_depth() {
+        let cfg = op(&["args.input.name", "args.input.credentials"], json!({}));
+        let req = build(
+            &cfg,
+            Surface::GraphQL,
+            Actor::default(),
+            json!({
+                "input": {
+                    "name": "gadget",
+                    "credentials": [
+                        {"kind": "password", "secret": "hunter2"},
+                        {"kind": "shared_key", "key": "abcd"}
+                    ]
+                }
+            }),
+            chrono::Utc::now(),
+        );
+        // Secret and key removed, kind kept.
+        let creds = &req.args["input"]["credentials"];
+        assert_eq!(creds[0]["kind"], "password");
+        assert!(creds[0].get("secret").is_none());
+        assert_eq!(creds[1]["kind"], "shared_key");
+        assert!(creds[1].get("key").is_none());
+    }
+
+    #[test]
+    fn extra_is_merged_and_static() {
+        let cfg = op(
+            &["actor.entity_id"],
+            json!({"entity_type": "entity", "v": 1}),
+        );
+        let req = build(
+            &cfg,
+            Surface::GraphQL,
+            Actor {
+                entity_id: "abc".into(),
+                ..Default::default()
+            },
+            json!({}),
+            chrono::Utc::now(),
+        );
+        assert_eq!(req.extra["entity_type"], "entity");
+        assert_eq!(req.extra["v"], 1);
+    }
+
+    #[test]
+    fn missing_include_path_is_silently_skipped() {
+        let cfg = op(&["actor.entity_id", "args.does.not.exist"], json!({}));
+        let req = build(
+            &cfg,
+            Surface::GraphQL,
+            Actor {
+                entity_id: "abc".into(),
+                ..Default::default()
+            },
+            json!({}),
+            chrono::Utc::now(),
+        );
+        assert_eq!(req.actor.entity_id, "abc");
+        assert!(req.args.is_null() || req.args.as_object().is_some_and(|m| m.is_empty()));
+    }
+}
diff --git a/src/callout/grpc.rs b/src/callout/grpc.rs
new file mode 100644
index 00000000..30ac2382
--- /dev/null
+++ b/src/callout/grpc.rs
@@ -0,0 +1,237 @@
+//! gRPC callout transport.
+//!
+//! One tonic client per endpoint, kept alive across calls. TLS/mTLS is
+//! configured at channel-build time; per-call timeout is enforced by the
+//! runner (`tokio::time::timeout`) around the RPC.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use tonic::transport::{Channel, ClientTlsConfig, Endpoint, Identity};
+
+use super::config::{EndpointConfig, GrpcTransportConfig, TlsConfig, TransportConfig};
+use super::envelope::{CalloutRequest, CalloutResponse, Decision};
+
+// Generated code from proto/atom/v1/callout.proto — client only.
+// The include! path is picked by tonic-build (package = atom.v1.callout).
+pub mod proto {
+    tonic::include_proto!("atom.v1.callout");
+}
+
+use proto::callout_client::CalloutClient;
+use proto::{
+    callout_response::Decision as ProtoDecision, Actor as ProtoActor,
+    CalloutRequest as ProtoRequest,
+};
+
+/// A built gRPC callout client for one endpoint.
+pub struct GrpcCallout {
+    client: CalloutClient<Channel>,
+    pub timeout: Duration,
+    endpoint_id: String,
+}
+
+impl GrpcCallout {
+    pub async fn build(cfg: &EndpointConfig) -> Result<Self> {
+        let grpc = match &cfg.transport {
+            TransportConfig::Grpc(g) => g.clone(),
+            TransportConfig::Http(_) => {
+                anyhow::bail!("GrpcCallout::build called on an http endpoint");
+            }
+        };
+        let channel = build_channel(&grpc, cfg.tls.as_ref(), cfg.timeout_ms).await?;
+        Ok(Self {
+            client: CalloutClient::new(channel),
+            timeout: Duration::from_millis(cfg.timeout_ms),
+            endpoint_id: cfg.id.as_str().to_string(),
+        })
+    }
+
+    pub async fn call(&self, req: &CalloutRequest) -> Result<CalloutResponse> {
+        let proto_req = envelope_to_proto(req)?;
+        // The channel-level timeout is a safety net; the runner also wraps the
+        // call in tokio::time::timeout for a hard deadline.
+        let mut client = self.client.clone();
+        let resp = client
+            .check(proto_req)
+            .await
+            .with_context(|| format!("callout gRPC check on {}", self.endpoint_id))?;
+        Ok(proto_to_response(resp.into_inner()))
+    }
+}
+
+async fn build_channel(
+    grpc: &GrpcTransportConfig,
+    tls: Option<&TlsConfig>,
+    timeout_ms: u64,
+) -> Result<Channel> {
+    let mut endpoint = Endpoint::from_shared(grpc.address.clone())
+        .with_context(|| format!("invalid grpc address: {}", grpc.address))?
+        .timeout(Duration::from_millis(timeout_ms.saturating_mul(2)))
+        .connect_timeout(Duration::from_millis(timeout_ms.saturating_mul(2)));
+
+    if let Some(tls) = tls {
+        // tonic's rustls stack does not support "skip verification" out of the
+        // box. We reject the combination at build time to avoid silently
+        // ignoring the operator's request.
+        if tls.insecure_skip_verify {
+            anyhow::bail!(
+                "grpc callout endpoint has insecure_skip_verify=true, which is not supported for gRPC — use HTTP or provide a CA bundle"
+            );
+        }
+        let mut tls_cfg = ClientTlsConfig::new();
+        if let Some(ca_path) = &tls.ca_path {
+            let pem = std::fs::read(ca_path)
+                .with_context(|| format!("read gRPC callout TLS CA {ca_path}"))?;
+            tls_cfg = tls_cfg.ca_certificate(tonic::transport::Certificate::from_pem(pem));
+        }
+        if let (Some(cert_path), Some(key_path)) = (&tls.client_cert_path, &tls.client_key_path) {
+            let cert = std::fs::read(cert_path)
+                .with_context(|| format!("read gRPC callout mTLS cert {cert_path}"))?;
+            let key = std::fs::read(key_path)
+                .with_context(|| format!("read gRPC callout mTLS key {key_path}"))?;
+            tls_cfg = tls_cfg.identity(Identity::from_pem(cert, key));
+        }
+        endpoint = endpoint
+            .tls_config(tls_cfg)
+            .context("apply gRPC TLS config")?;
+    }
+
+    endpoint.connect_lazy().pipe_ok()
+}
+
+/// Tiny helper so `.connect_lazy()` (which returns `Channel`, not `Result`)
+/// can compose in the `?` chain above.
+trait PipeOk<T> {
+    fn pipe_ok(self) -> Result<T>;
+}
+impl PipeOk<Channel> for Channel {
+    fn pipe_ok(self) -> Result<Channel> {
+        Ok(self)
+    }
+}
+
+fn envelope_to_proto(req: &CalloutRequest) -> Result<ProtoRequest> {
+    Ok(ProtoRequest {
+        operation: req.operation.clone(),
+        surface: req.surface.clone(),
+        request_id: req.request_id.clone(),
+        time: req.time.clone(),
+        actor: Some(ProtoActor {
+            entity_id: req.actor.entity_id.clone(),
+            tenant_id: req.actor.tenant_id.clone(),
+            scope: req.actor.scope.clone(),
+            credential_id: req.actor.credential_id.clone(),
+            source_ip: req.actor.source_ip.clone(),
+            user_agent: req.actor.user_agent.clone(),
+        }),
+        args: value_to_struct(&req.args),
+        extra: value_to_struct(&req.extra),
+    })
+}
+
+fn value_to_struct(v: &serde_json::Value) -> Option<prost_types::Struct> {
+    match v {
+        serde_json::Value::Object(map) => {
+            let fields = map
+                .iter()
+                .map(|(k, v)| (k.clone(), value_to_prost(v)))
+                .collect();
+            Some(prost_types::Struct { fields })
+        }
+        serde_json::Value::Null => None,
+        // Non-object envelope fields (unlikely but not impossible) become a
+        // one-entry struct under "_value".
+        other => {
+            let mut fields = std::collections::BTreeMap::new();
+            fields.insert("_value".to_string(), value_to_prost(other));
+            Some(prost_types::Struct {
+                fields: fields.into_iter().collect(),
+            })
+        }
+    }
+}
+
+fn value_to_prost(v: &serde_json::Value) -> prost_types::Value {
+    use prost_types::value::Kind;
+    let kind = match v {
+        serde_json::Value::Null => Kind::NullValue(0),
+        serde_json::Value::Bool(b) => Kind::BoolValue(*b),
+        serde_json::Value::Number(n) => Kind::NumberValue(n.as_f64().unwrap_or(0.0)),
+        serde_json::Value::String(s) => Kind::StringValue(s.clone()),
+        serde_json::Value::Array(arr) => {
+            let values = arr.iter().map(value_to_prost).collect();
+            Kind::ListValue(prost_types::ListValue { values })
+        }
+        serde_json::Value::Object(map) => {
+            let fields = map
+                .iter()
+                .map(|(k, v)| (k.clone(), value_to_prost(v)))
+                .collect();
+            Kind::StructValue(prost_types::Struct { fields })
+        }
+    };
+    prost_types::Value { kind: Some(kind) }
+}
+
+fn proto_to_response(resp: proto::CalloutResponse) -> CalloutResponse {
+    let decision = match ProtoDecision::try_from(resp.decision) {
+        Ok(ProtoDecision::Allow) => Decision::Allow,
+        Ok(ProtoDecision::Deny) => Decision::Deny,
+        // Zero-value / unknown → deny (fail-closed on decode ambiguity).
+        Err(_) => Decision::Deny,
+    };
+    let reason = if matches!(decision, Decision::Deny) && resp.reason.trim().is_empty() {
+        "callout denied".to_string()
+    } else {
+        resp.reason
+    };
+    CalloutResponse { decision, reason }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::callout::envelope::Actor;
+
+    #[test]
+    fn value_to_struct_round_trips_object() {
+        let v = serde_json::json!({"a": 1, "b": "x", "c": [true, false]});
+        let s = value_to_struct(&v).expect("struct");
+        assert!(s.fields.contains_key("a"));
+        assert!(s.fields.contains_key("b"));
+        assert!(s.fields.contains_key("c"));
+    }
+
+    #[test]
+    fn envelope_to_proto_maps_all_fields() {
+        let req = CalloutRequest {
+            operation: "createEntity".into(),
+            surface: "graphql".into(),
+            request_id: "r1".into(),
+            time: "2026-01-01T00:00:00Z".into(),
+            actor: Actor {
+                entity_id: "abc".into(),
+                ..Default::default()
+            },
+            args: serde_json::json!({"input": {"name": "gadget"}}),
+            extra: serde_json::json!({}),
+        };
+        let p = envelope_to_proto(&req).unwrap();
+        assert_eq!(p.operation, "createEntity");
+        assert_eq!(p.surface, "graphql");
+        assert_eq!(p.actor.unwrap().entity_id, "abc");
+        assert!(p.args.is_some());
+    }
+
+    #[test]
+    fn unknown_decision_is_deny() {
+        let resp = proto::CalloutResponse {
+            decision: 99,
+            reason: String::new(),
+        };
+        let r = proto_to_response(resp);
+        assert!(matches!(r.decision, Decision::Deny));
+        assert_eq!(r.reason, "callout denied");
+    }
+}
diff --git a/src/callout/http.rs b/src/callout/http.rs
new file mode 100644
index 00000000..a60b5912
--- /dev/null
+++ b/src/callout/http.rs
@@ -0,0 +1,215 @@
+//! HTTP callout transport.
+//!
+//! Builds a per-endpoint `reqwest::Client` at startup (TLS/mTLS applied then),
+//! so each call is a single HTTP round-trip and cannot be tripped up by
+//! file-not-found errors mid-request. `on_error` and `timeout_ms` are enforced
+//! by the runner around this — this module reports outcomes and lets the
+//! runner apply the config's policy.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use reqwest::Client;
+
+use super::config::{EndpointConfig, HttpMethod, HttpTransportConfig, TlsConfig, TransportConfig};
+use super::envelope::{CalloutRequest, CalloutResponse, Decision};
+
+/// A built HTTP callout client for one endpoint.
+pub struct HttpCallout {
+    client: Client,
+    url: String,
+    method: HttpMethod,
+    headers: Vec<(String, String)>,
+    /// Kept separate from `client.timeout` so the chain runner can wrap this
+    /// with `tokio::time::timeout` for a hard upper bound independent of any
+    /// keep-alive / DNS quirks.
+    pub timeout: Duration,
+}
+
+impl HttpCallout {
+    pub fn build(cfg: &EndpointConfig) -> Result<Self> {
+        let http = match &cfg.transport {
+            TransportConfig::Http(h) => h.clone(),
+            TransportConfig::Grpc(_) => {
+                anyhow::bail!("HttpCallout::build called on a grpc endpoint");
+            }
+        };
+        let client = build_client(&http, cfg.tls.as_ref(), cfg.timeout_ms)?;
+        Ok(Self {
+            client,
+            url: http.url.clone(),
+            method: http.method,
+            headers: http.headers.into_iter().collect(),
+            timeout: Duration::from_millis(cfg.timeout_ms),
+        })
+    }
+
+    pub async fn call(&self, req: &CalloutRequest) -> Result<CalloutResponse> {
+        let mut builder = match self.method {
+            HttpMethod::Post => self.client.post(&self.url).json(req),
+            HttpMethod::Get => {
+                let query = envelope_to_query(req)?;
+                self.client.get(&self.url).query(&query)
+            }
+        };
+        for (k, v) in &self.headers {
+            builder = builder.header(k, v);
+        }
+        let resp = builder
+            .send()
+            .await
+            .with_context(|| format!("callout HTTP send to {}", self.url))?;
+        let status = resp.status();
+        if !status.is_success() {
+            let body = resp.text().await.unwrap_or_default();
+            anyhow::bail!(
+                "callout HTTP returned non-success status {status}: {}",
+                truncate(&body, 512)
+            );
+        }
+        // Two acceptable success shapes:
+        //   1. { "decision": "allow" | "deny", "reason": "..." }
+        //   2. HTTP 2xx with no body / non-JSON body: treated as ALLOW
+        //      (magistrala v0.14 parity — status alone is the signal).
+        let text = resp.text().await.unwrap_or_default();
+        if text.trim().is_empty() {
+            return Ok(CalloutResponse::allow());
+        }
+        match serde_json::from_str::<CalloutResponse>(&text) {
+            Ok(mut r) => {
+                if matches!(r.decision, Decision::Deny) && r.reason.trim().is_empty() {
+                    r.reason = "callout denied".to_string();
+                }
+                Ok(r)
+            }
+            Err(_) => Ok(CalloutResponse::allow()),
+        }
+    }
+}
+
+fn build_client(
+    http: &HttpTransportConfig,
+    tls: Option<&TlsConfig>,
+    timeout_ms: u64,
+) -> Result<Client> {
+    let mut builder =
+        Client::builder().timeout(Duration::from_millis(timeout_ms.saturating_mul(2)));
+    if let Some(tls) = tls {
+        if tls.insecure_skip_verify {
+            builder = builder.danger_accept_invalid_certs(true);
+        }
+        if let Some(ca_path) = &tls.ca_path {
+            let pem =
+                std::fs::read(ca_path).with_context(|| format!("read callout TLS CA {ca_path}"))?;
+            for cert in reqwest::Certificate::from_pem_bundle(&pem)
+                .with_context(|| format!("parse callout TLS CA {ca_path}"))?
+            {
+                builder = builder.add_root_certificate(cert);
+            }
+        }
+        if let (Some(cert_path), Some(key_path)) = (&tls.client_cert_path, &tls.client_key_path) {
+            let cert_pem = std::fs::read(cert_path)
+                .with_context(|| format!("read callout mTLS cert {cert_path}"))?;
+            let key_pem = std::fs::read(key_path)
+                .with_context(|| format!("read callout mTLS key {key_path}"))?;
+            let mut identity_pem = cert_pem;
+            identity_pem.push(b'\n');
+            identity_pem.extend_from_slice(&key_pem);
+            let identity = reqwest::Identity::from_pem(&identity_pem)
+                .with_context(|| format!("build callout mTLS identity from {cert_path}"))?;
+            builder = builder.identity(identity);
+        }
+    }
+    // Sanity-check the URL early so a typo surfaces at startup, not runtime.
+    let _ = url::Url::parse(&http.url).with_context(|| format!("invalid url: {}", http.url))?;
+    builder.build().context("build callout HTTP client")
+}
+
+fn envelope_to_query(req: &CalloutRequest) -> Result<Vec<(String, String)>> {
+    // Flatten the envelope into query-string form: mirrors magistrala v0.14
+    // `Request.toURL()` — keys like "operation", "actor.entity_id", "args.input.name".
+    let val = serde_json::to_value(req)?;
+    let mut out = Vec::new();
+    flatten_json(&val, String::new(), &mut out);
+    Ok(out)
+}
+
+fn flatten_json(val: &serde_json::Value, prefix: String, out: &mut Vec<(String, String)>) {
+    match val {
+        serde_json::Value::Object(map) => {
+            for (k, v) in map {
+                let next = if prefix.is_empty() {
+                    k.clone()
+                } else {
+                    format!("{prefix}.{k}")
+                };
+                flatten_json(v, next, out);
+            }
+        }
+        serde_json::Value::Array(arr) => {
+            for (i, v) in arr.iter().enumerate() {
+                let next = format!("{prefix}[{i}]");
+                flatten_json(v, next, out);
+            }
+        }
+        serde_json::Value::Null => {}
+        serde_json::Value::Bool(b) => out.push((prefix, b.to_string())),
+        serde_json::Value::Number(n) => out.push((prefix, n.to_string())),
+        serde_json::Value::String(s) => out.push((prefix, s.clone())),
+    }
+}
+
+fn truncate(s: &str, max: usize) -> String {
+    if s.len() <= max {
+        s.to_string()
+    } else {
+        format!("{}…", &s[..max])
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::callout::config::HttpTransportConfig;
+    use crate::callout::envelope::Actor;
+
+    fn dummy_request() -> CalloutRequest {
+        CalloutRequest {
+            operation: "createEntity".into(),
+            surface: "graphql".into(),
+            request_id: "r1".into(),
+            time: "2026-01-01T00:00:00Z".into(),
+            actor: Actor {
+                entity_id: "abc".into(),
+                ..Default::default()
+            },
+            args: serde_json::json!({"input": {"name": "gadget"}}),
+            extra: serde_json::json!({"entity_type": "entity"}),
+        }
+    }
+
+    #[test]
+    fn envelope_flattens_to_query_pairs() {
+        let req = dummy_request();
+        let pairs = envelope_to_query(&req).unwrap();
+        let m: std::collections::HashMap<_, _> = pairs.into_iter().collect();
+        assert_eq!(m.get("operation").map(String::as_str), Some("createEntity"));
+        assert_eq!(m.get("surface").map(String::as_str), Some("graphql"));
+        assert_eq!(m.get("actor.entity_id").map(String::as_str), Some("abc"));
+        assert_eq!(m.get("args.input.name").map(String::as_str), Some("gadget"));
+        assert_eq!(
+            m.get("extra.entity_type").map(String::as_str),
+            Some("entity")
+        );
+    }
+
+    #[test]
+    fn build_client_rejects_invalid_url() {
+        let http = HttpTransportConfig {
+            url: "not-a-url".to_string(),
+            method: HttpMethod::Post,
+            headers: Default::default(),
+        };
+        assert!(build_client(&http, None, 500).is_err());
+    }
+}
diff --git a/src/callout/mod.rs b/src/callout/mod.rs
new file mode 100644
index 00000000..f3657d98
--- /dev/null
+++ b/src/callout/mod.rs
@@ -0,0 +1,51 @@
+//! External policy callouts.
+//!
+//! At certain configured operations (GraphQL resolvers or gRPC methods) atom
+//! consults an external policy service **before** executing the operation. The
+//! external service replies with ALLOW or DENY; DENY short-circuits the
+//! operation with the returned reason, and any transport error follows the
+//! per-endpoint `on_error` policy (default: deny — matches atom's default-deny
+//! invariant).
+//!
+//! Design:
+//! - Per-operation opt-in via YAML config (loaded once at startup from
+//!   `ATOM_CALLOUTS_FILE`). If an operation is not listed, the interception is
+//!   a cheap map lookup that returns early.
+//! - HTTP (POST/GET) and gRPC transports share one canonical
+//!   [`envelope::CalloutRequest`] shape.
+//! - Multiple endpoints per operation run sequentially, fail-fast (all must
+//!   allow — matches magistrala v0.14 semantics).
+//! - Per-operation field whitelist (`include:`) selects which args make it into
+//!   the payload. A hard denylist strips secret/password/key even if the
+//!   whitelist would have leaked them.
+//! - Fail-closed on transport errors and timeouts.
+
+pub mod config;
+pub mod envelope;
+pub mod grpc;
+pub mod http;
+pub mod runner;
+
+pub use config::{
+    CalloutsConfig, EndpointConfig, EndpointId, OnError, OperationConfig, TlsConfig,
+    TransportConfig,
+};
+pub use envelope::{Actor, CalloutRequest, CalloutResponse, Decision};
+pub use runner::{check, CalloutOutcome, CalloutService};
+
+/// The operation surface — matches the `surface:` field in callouts.yaml and
+/// the `surface` field on the wire.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Surface {
+    GraphQL,
+    Grpc,
+}
+
+impl Surface {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::GraphQL => "graphql",
+            Self::Grpc => "grpc",
+        }
+    }
+}
diff --git a/src/callout/runner.rs b/src/callout/runner.rs
new file mode 100644
index 00000000..7fe587bf
--- /dev/null
+++ b/src/callout/runner.rs
@@ -0,0 +1,241 @@
+//! Chain runner — builds callout clients once at startup and dispatches per-op.
+//!
+//! At startup the runner walks the resolved config, builds one HTTP or gRPC
+//! client per endpoint id, and stores them in a hash keyed by id. At request
+//! time it looks up the operation, walks its `endpoints:` list in order,
+//! sends the envelope to each, and short-circuits on the first non-ALLOW.
+//! `on_error` per endpoint controls what happens on transport error/timeout
+//! (default: `deny` — matches atom's default-deny invariant).
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use anyhow::Result;
+
+use super::config::{CalloutsConfig, EndpointConfig, EndpointId, OnError, TransportConfig};
+use super::envelope::{Actor, CalloutRequest, CalloutResponse, Decision};
+use super::grpc::GrpcCallout;
+use super::http::HttpCallout;
+use super::Surface;
+
+/// Outcome returned to the caller (GraphQL extension / gRPC handler).
+#[derive(Debug, Clone)]
+pub enum CalloutOutcome {
+    Allow,
+    Deny {
+        reason: String,
+        endpoint_id: String,
+    },
+    /// No callout was configured for this operation — the caller proceeds
+    /// unchanged. Distinct from `Allow` so we can skip audit + metrics noise
+    /// for the (very common) no-op case.
+    NotConfigured,
+}
+
+enum EndpointClient {
+    Http(HttpCallout),
+    Grpc(GrpcCallout),
+}
+
+impl EndpointClient {
+    async fn call(&self, req: &CalloutRequest) -> Result<CalloutResponse> {
+        match self {
+            Self::Http(c) => c.call(req).await,
+            Self::Grpc(c) => c.call(req).await,
+        }
+    }
+
+    fn timeout(&self) -> Duration {
+        match self {
+            Self::Http(c) => c.timeout,
+            Self::Grpc(c) => c.timeout,
+        }
+    }
+}
+
+/// Callout service — built once at startup, cheap to clone (Arc'd inside).
+#[derive(Clone, Default)]
+pub struct CalloutService {
+    inner: Option<Arc<Inner>>,
+}
+
+struct Inner {
+    config: CalloutsConfig,
+    clients: HashMap<EndpointId, EndpointClient>,
+}
+
+impl CalloutService {
+    /// Empty (no-op) service — every `check` returns `NotConfigured`.
+    pub fn disabled() -> Self {
+        Self { inner: None }
+    }
+
+    /// Build the service from resolved config, connecting/preparing every
+    /// referenced endpoint. Endpoint connect failures are fatal: the operator
+    /// asked for callouts and unreachable endpoints must be caught at boot.
+    pub async fn build(config: CalloutsConfig) -> Result<Self> {
+        if config.is_empty() {
+            return Ok(Self::disabled());
+        }
+        let mut clients: HashMap<EndpointId, EndpointClient> = HashMap::new();
+        for ep in config.endpoints() {
+            let client = build_endpoint(ep).await?;
+            clients.insert(ep.id.clone(), client);
+        }
+        Ok(Self {
+            inner: Some(Arc::new(Inner { config, clients })),
+        })
+    }
+
+    /// Look up the resolved config for a GraphQL resolver.
+    pub fn graphql_op(&self, name: &str) -> Option<&super::config::OperationConfig> {
+        self.inner.as_ref()?.config.graphql_op(name)
+    }
+
+    pub fn grpc_op(&self, name: &str) -> Option<&super::config::OperationConfig> {
+        self.inner.as_ref()?.config.grpc_op(name)
+    }
+
+    /// Fire the callout chain for the given operation. Returns immediately
+    /// with `NotConfigured` when no operation entry exists (the common case).
+    pub async fn check(
+        &self,
+        surface: Surface,
+        name: &str,
+        actor: Actor,
+        args: serde_json::Value,
+    ) -> CalloutOutcome {
+        let Some(inner) = self.inner.as_ref() else {
+            return CalloutOutcome::NotConfigured;
+        };
+        let op = match surface {
+            Surface::GraphQL => inner.config.graphql_op(name),
+            Surface::Grpc => inner.config.grpc_op(name),
+        };
+        let Some(op) = op else {
+            return CalloutOutcome::NotConfigured;
+        };
+        let req = super::envelope::build(op, surface, actor, args, chrono::Utc::now());
+        // Sequential fail-fast — mirrors magistrala v0.14 semantics.
+        for ep_id in &op.endpoints {
+            let Some(client) = inner.clients.get(ep_id) else {
+                // Should be impossible: config.build() rejects unknown refs.
+                tracing::error!(endpoint = %ep_id, "callout endpoint missing at runtime");
+                return CalloutOutcome::Deny {
+                    reason: format!("callout endpoint {ep_id} missing"),
+                    endpoint_id: ep_id.to_string(),
+                };
+            };
+            let ep_cfg = inner
+                .config
+                .endpoint(ep_id)
+                .expect("endpoint config present");
+            let start = Instant::now();
+            let result = tokio::time::timeout(client.timeout(), client.call(&req)).await;
+            let elapsed = start.elapsed();
+            match result {
+                Ok(Ok(resp)) => {
+                    crate::metrics::record_callout(
+                        &op.name,
+                        ep_id.as_str(),
+                        transport_label(&ep_cfg.transport),
+                        callout_result_label(&resp.decision),
+                        elapsed,
+                    );
+                    match resp.decision {
+                        Decision::Allow => continue,
+                        Decision::Deny => {
+                            return CalloutOutcome::Deny {
+                                reason: if resp.reason.is_empty() {
+                                    "callout denied".to_string()
+                                } else {
+                                    resp.reason
+                                },
+                                endpoint_id: ep_id.to_string(),
+                            };
+                        }
+                    }
+                }
+                Ok(Err(e)) => {
+                    crate::metrics::record_callout(
+                        &op.name,
+                        ep_id.as_str(),
+                        transport_label(&ep_cfg.transport),
+                        "transport_error",
+                        elapsed,
+                    );
+                    tracing::warn!(
+                        endpoint = %ep_id,
+                        error = %e,
+                        "callout transport error"
+                    );
+                    match ep_cfg.on_error {
+                        OnError::Allow => continue,
+                        OnError::Deny => {
+                            return CalloutOutcome::Deny {
+                                reason: format!("callout {ep_id} transport error: {e}"),
+                                endpoint_id: ep_id.to_string(),
+                            };
+                        }
+                    }
+                }
+                Err(_) => {
+                    crate::metrics::record_callout(
+                        &op.name,
+                        ep_id.as_str(),
+                        transport_label(&ep_cfg.transport),
+                        "timeout",
+                        elapsed,
+                    );
+                    tracing::warn!(endpoint = %ep_id, "callout timed out");
+                    match ep_cfg.on_error {
+                        OnError::Allow => continue,
+                        OnError::Deny => {
+                            return CalloutOutcome::Deny {
+                                reason: format!("callout {ep_id} timed out"),
+                                endpoint_id: ep_id.to_string(),
+                            };
+                        }
+                    }
+                }
+            }
+        }
+        CalloutOutcome::Allow
+    }
+}
+
+async fn build_endpoint(cfg: &EndpointConfig) -> Result<EndpointClient> {
+    match &cfg.transport {
+        TransportConfig::Http(_) => Ok(EndpointClient::Http(HttpCallout::build(cfg)?)),
+        TransportConfig::Grpc(_) => Ok(EndpointClient::Grpc(GrpcCallout::build(cfg).await?)),
+    }
+}
+
+fn transport_label(t: &TransportConfig) -> &'static str {
+    match t {
+        TransportConfig::Http(_) => "http",
+        TransportConfig::Grpc(_) => "grpc",
+    }
+}
+
+fn callout_result_label(d: &Decision) -> &'static str {
+    match d {
+        Decision::Allow => "allow",
+        Decision::Deny => "deny",
+    }
+}
+
+/// Convenience wrapper for a call from the state's `CalloutService`.
+///
+/// Kept as a free function so the GraphQL extension and gRPC handlers can
+/// share one call site.
+pub async fn check(
+    svc: &CalloutService,
+    surface: Surface,
+    name: &str,
+    actor: Actor,
+    args: serde_json::Value,
+) -> CalloutOutcome {
+    svc.check(surface, name, actor, args).await
+}
diff --git a/src/config.rs b/src/config.rs
index e4a46ac2..233c4e0e 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -40,6 +40,9 @@ pub struct Config {
     /// If set, the service entity's password credential is created on first boot.
     pub service_secret: Option<String>,
     pub service_entity_id: Uuid,
+    /// Path to a YAML bootstrap file applied idempotently at startup. `None`
+    /// disables config-file bootstrap (env-var/API bootstrap is unaffected).
+    pub bootstrap_file: Option<String>,
     /// Enables unauthenticated global human self-registration.
     pub self_registration_enabled: bool,
     /// Development-only: allow password login before the signup email is verified.
@@ -498,6 +501,7 @@ impl Config {
                 .ok()
                 .and_then(|s| s.parse().ok())
                 .unwrap_or(SERVICE_ENTITY_ID),
+            bootstrap_file: nonempty_env("ATOM_BOOTSTRAP_FILE"),
             self_registration_enabled: env_bool_default("ATOM_SELF_REGISTRATION_ENABLED", true),
             dev_allow_unverified_email_login: env_bool("ATOM_ALLOW_UNVERIFIED_EMAIL_LOGIN"),
             cors_allowed_origins: parse_cors_allowed_origins(&public_base_url),
@@ -578,6 +582,7 @@ impl Config {
             admin_secret: None,
             service_secret: None,
             service_entity_id: SERVICE_ENTITY_ID,
+            bootstrap_file: None,
             self_registration_enabled: false,
             dev_allow_unverified_email_login: false,
             public_base_url: "http://localhost:8080".into(),
diff --git a/src/graphql/callout_ext.rs b/src/graphql/callout_ext.rs
new file mode 100644
index 00000000..529d5ca7
--- /dev/null
+++ b/src/graphql/callout_ext.rs
@@ -0,0 +1,227 @@
+//! async-graphql extension that fires per-op callouts before executing.
+//!
+//! Registered once in `schema.rs`. In `parse_query` we walk the parsed
+//! document, resolve variables against the request's `Variables`, and record
+//! one pending callout per top-level field that has a matching entry in
+//! `CalloutService`. In `execute` we run the callout chain sequentially; a
+//! single DENY short-circuits the whole request with a GraphQL error carrying
+//! the callout's reason and the endpoint id that denied.
+//!
+//! We can't run callouts inside `resolve` because `ExtensionContext` in
+//! async-graphql 7.2 does not expose the request's `Variables` to that hook.
+//! `parse_query` receives them explicitly, so this is where argument
+//! resolution happens.
+//!
+//! Ordering: the extension runs *after* `graphql_handler` puts `AuthContext`
+//! into request data, so `actor` is populated. It runs *before* any resolver
+//! body, so scope gates / PDP / repo mutations only execute on ALLOW.
+
+use std::sync::{Arc, Mutex};
+
+use async_graphql::{
+    extensions::{Extension, ExtensionContext, ExtensionFactory, NextExecute, NextParseQuery},
+    parser::types::{DocumentOperations, ExecutableDocument, Field, Selection, SelectionSet},
+    Name, Response, ServerError, ServerResult, Variables,
+};
+use async_graphql_value::ConstValue;
+use serde_json::Value as JsonValue;
+
+use crate::{
+    audit,
+    auth::AuthContext,
+    callout::{envelope::Actor, CalloutOutcome, Surface},
+    models::enums::AuditOutcome,
+    state::AppState,
+};
+
+/// Factory registered on the schema builder. Reused across requests.
+pub struct CalloutExtensionFactory;
+
+impl ExtensionFactory for CalloutExtensionFactory {
+    fn create(&self) -> Arc<dyn Extension> {
+        Arc::new(CalloutExtension {
+            pending: Mutex::new(PendingByOperation::default()),
+        })
+    }
+}
+
+#[derive(Default)]
+struct PendingByOperation {
+    /// Callouts to run when a specific named operation executes.
+    named: std::collections::HashMap<String, Vec<Pending>>,
+    /// Callouts to run for the single anonymous operation.
+    anonymous: Vec<Pending>,
+}
+
+struct Pending {
+    resolver: String,
+    args: JsonValue,
+}
+
+struct CalloutExtension {
+    pending: Mutex<PendingByOperation>,
+}
+
+#[async_trait::async_trait]
+impl Extension for CalloutExtension {
+    async fn parse_query(
+        &self,
+        ctx: &ExtensionContext<'_>,
+        query: &str,
+        variables: &Variables,
+        next: NextParseQuery<'_>,
+    ) -> ServerResult<ExecutableDocument> {
+        let doc = next.run(ctx, query, variables).await?;
+        let Some(state) = ctx.data_opt::<AppState>() else {
+            return Ok(doc);
+        };
+        let mut pending = self.pending.lock().expect("callout pending mutex");
+        match &doc.operations {
+            DocumentOperations::Single(op) => {
+                collect_pending(
+                    state,
+                    &op.node.selection_set.node,
+                    variables,
+                    &mut pending.anonymous,
+                );
+            }
+            DocumentOperations::Multiple(map) => {
+                for (name, op) in map {
+                    let mut list = Vec::new();
+                    collect_pending(state, &op.node.selection_set.node, variables, &mut list);
+                    if !list.is_empty() {
+                        pending.named.insert(name.to_string(), list);
+                    }
+                }
+            }
+        }
+        Ok(doc)
+    }
+
+    async fn execute(
+        &self,
+        ctx: &ExtensionContext<'_>,
+        operation_name: Option<&str>,
+        next: NextExecute<'_>,
+    ) -> Response {
+        let Some(state) = ctx.data_opt::<AppState>() else {
+            return next.run(ctx, operation_name).await;
+        };
+        let pending = self
+            .pending
+            .lock()
+            .expect("callout pending mutex")
+            .take_for(operation_name);
+        if pending.is_empty() {
+            return next.run(ctx, operation_name).await;
+        }
+        let auth = ctx.data_opt::<AuthContext>().cloned().unwrap_or_default();
+        for p in pending {
+            let actor = Actor::from_auth(&auth);
+            let outcome = state
+                .callouts
+                .check(Surface::GraphQL, &p.resolver, actor, p.args)
+                .await;
+            match outcome {
+                CalloutOutcome::Allow | CalloutOutcome::NotConfigured => continue,
+                CalloutOutcome::Deny {
+                    reason,
+                    endpoint_id,
+                } => {
+                    audit_callout_deny(state, &auth, &p.resolver, &endpoint_id, &reason);
+                    let message = format!("callout denied ({endpoint_id}): {reason}");
+                    return Response::from_errors(vec![ServerError::new(message, None)]);
+                }
+            }
+        }
+        next.run(ctx, operation_name).await
+    }
+}
+
+impl PendingByOperation {
+    fn take_for(&mut self, operation_name: Option<&str>) -> Vec<Pending> {
+        match operation_name {
+            Some(name) => self.named.remove(name).unwrap_or_default(),
+            None => std::mem::take(&mut self.anonymous),
+        }
+    }
+}
+
+fn collect_pending(
+    state: &AppState,
+    sel: &SelectionSet,
+    variables: &Variables,
+    out: &mut Vec<Pending>,
+) {
+    for item in &sel.items {
+        if let Selection::Field(field) = &item.node {
+            let name = field.node.name.node.as_str();
+            if state.callouts.graphql_op(name).is_none() {
+                continue;
+            }
+            out.push(Pending {
+                resolver: name.to_string(),
+                args: field_args_to_json(&field.node, variables),
+            });
+        }
+        // Fragments are unusual on top-level fields; the resolver-name based
+        // gate model doesn't extend naturally to them. We ignore them here —
+        // the alternative would be to resolve them and re-walk, which
+        // complicates the model without matching a real use case.
+    }
+}
+
+fn field_args_to_json(field: &Field, variables: &Variables) -> JsonValue {
+    let mut out = serde_json::Map::new();
+    for (name, value) in &field.arguments {
+        let const_val = value
+            .node
+            .clone()
+            .into_const_with::<()>(|var| resolve_variable(variables, &var).ok_or(()))
+            .unwrap_or(ConstValue::Null);
+        let json = const_val.into_json().unwrap_or(JsonValue::Null);
+        out.insert(name.node.to_string(), json);
+    }
+    JsonValue::Object(out)
+}
+
+fn resolve_variable(variables: &Variables, name: &Name) -> Option<ConstValue> {
+    variables.get(name).cloned()
+}
+
+fn audit_callout_deny(
+    state: &AppState,
+    auth: &AuthContext,
+    operation: &str,
+    endpoint: &str,
+    reason: &str,
+) {
+    let pool = state.pool.clone();
+    let actor_id = (!auth.entity_id.is_nil()).then_some(auth.entity_id);
+    let tenant_id = auth.tenant_id;
+    let events_enabled = state.config.events.enabled();
+    let operation = operation.to_string();
+    let endpoint = endpoint.to_string();
+    let reason = reason.to_string();
+    tokio::spawn(async move {
+        audit::write(
+            &pool,
+            events_enabled,
+            audit::AuditEvent {
+                actor_entity_id: actor_id,
+                tenant_id,
+                target_kind: Some("callout"),
+                target_id: None,
+                event: "callout.deny",
+                outcome: AuditOutcome::Deny,
+                details: serde_json::json!({
+                    "operation": operation,
+                    "surface": "graphql",
+                    "endpoint": endpoint,
+                    "reason": reason,
+                }),
+            },
+        )
+        .await;
+    });
+}
diff --git a/src/graphql/mod.rs b/src/graphql/mod.rs
index 0a1dbbe2..61716322 100644
--- a/src/graphql/mod.rs
+++ b/src/graphql/mod.rs
@@ -2,6 +2,7 @@ pub mod admin;
 pub mod api_endpoints;
 pub mod auth;
 pub mod authz;
+pub mod callout_ext;
 pub mod certificates;
 pub mod credentials;
 pub mod entities;
diff --git a/src/graphql/schema.rs b/src/graphql/schema.rs
index ca494530..85a23089 100644
--- a/src/graphql/schema.rs
+++ b/src/graphql/schema.rs
@@ -3,6 +3,7 @@ use async_graphql::{EmptySubscription, Schema};
 use crate::state::AppState;
 
 use super::{
+    callout_ext::CalloutExtensionFactory,
     mutation::{mutation_root, MutationRoot},
     query::QueryRoot,
 };
@@ -14,6 +15,7 @@ pub fn build_schema(state: AppState) -> AtomSchema {
     let builder = Schema::build(QueryRoot::default(), mutation_root(), EmptySubscription)
         .limit_depth(limits.max_depth)
         .limit_complexity(limits.max_complexity)
+        .extension(CalloutExtensionFactory)
         .data(state)
         .disable_suggestions();
     if limits.introspection_enabled {
diff --git a/src/graphql/types/mod.rs b/src/graphql/types/mod.rs
index 40bf7ec0..620816c5 100644
--- a/src/graphql/types/mod.rs
+++ b/src/graphql/types/mod.rs
@@ -267,6 +267,12 @@ impl Entity {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when the row was provisioned from the bootstrap YAML.
+    /// The UI uses this to disable mutation buttons on config-managed rows.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct Session(pub session_model::Session);
@@ -391,6 +397,11 @@ impl Tenant {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct TenantInvitation(pub tenant_model::TenantInvitation);
@@ -505,6 +516,11 @@ impl Resource {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct ApiEndpoint(pub api_endpoint_model::ApiEndpoint);
@@ -676,6 +692,11 @@ impl Group {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct Credential(pub CredentialData);
@@ -688,6 +709,7 @@ pub struct CredentialData {
     pub status: CredentialStatus,
     pub expires_at: Option<DateTime<Utc>>,
     pub created_at: DateTime<Utc>,
+    pub managed_by: Option<String>,
 }
 
 #[Object]
@@ -719,6 +741,12 @@ impl Credential {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when the credential was provisioned from the bootstrap YAML.
+    /// The UI uses this to render the row read-only.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct SharedKeyResponse(pub token_model::SharedKeyResponse);
@@ -818,6 +846,12 @@ impl AccessToken {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when the token was provisioned from the bootstrap YAML.
+    /// The UI uses this to render the row read-only.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 fn clone_permission_summary(
@@ -935,6 +969,11 @@ impl Role {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct RolePermissionBlock(pub role_model::RolePermissionBlock);
@@ -1028,6 +1067,11 @@ impl Capability {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct Action(pub capability_model::Capability);
@@ -1059,6 +1103,11 @@ impl Action {
     async fn updated_at(&self) -> Option<String> {
         self.0.updated_at.map(timestamp)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct ActionApplicability(pub capability_model::CapabilityApplicability);
@@ -1072,6 +1121,11 @@ impl ActionApplicability {
     async fn object_type(&self) -> Option<&str> {
         self.0.object_type.as_deref()
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct ActionApplicabilityEntry(pub capability_model::CapabilityApplicabilityEntry);
@@ -1110,6 +1164,11 @@ impl ActionApplicabilityEntry {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct ActionAssignmentRule(pub action_assignment_rule_model::ActionAssignmentRule);
@@ -1151,6 +1210,11 @@ impl ActionAssignmentRule {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct CapabilityApplicability(pub capability_model::CapabilityApplicability);
@@ -1164,6 +1228,11 @@ impl CapabilityApplicability {
     async fn object_type(&self) -> Option<&str> {
         self.0.object_type.as_deref()
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 pub struct CapabilityApplicabilityEntry(pub capability_model::CapabilityApplicabilityEntry);
@@ -1202,6 +1271,11 @@ impl CapabilityApplicabilityEntry {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 #[derive(Default)]
@@ -1339,6 +1413,11 @@ impl PermissionBlock {
     async fn updated_at(&self) -> String {
         timestamp(self.0.updated_at)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 impl From<policy_model::PermissionBlock> for PermissionBlock {
@@ -1382,6 +1461,11 @@ impl RoleAssignment {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 impl From<policy_model::RoleAssignment> for RoleAssignment {
@@ -1425,6 +1509,11 @@ impl DirectPolicy {
     async fn created_at(&self) -> String {
         timestamp(self.0.created_at)
     }
+
+    /// `"config"` when provisioned from the bootstrap YAML.
+    async fn managed_by(&self) -> Option<&str> {
+        self.0.managed_by.as_deref()
+    }
 }
 
 impl From<policy_model::DirectPolicy> for DirectPolicy {
@@ -2437,6 +2526,7 @@ impl From<identity_service::CredentialSummary> for Credential {
             status: credential.status,
             expires_at: credential.expires_at,
             created_at: credential.created_at,
+            managed_by: credential.managed_by,
         })
     }
 }
@@ -2546,6 +2636,10 @@ impl From<access_model::ExpiringCredentialItem> for Credential {
             status: credential.status,
             expires_at: Some(credential.expires_at),
             created_at: credential.created_at,
+            // ExpiringCredentialItem is a compliance report of about-to-expire
+            // rows; bootstrap credentials have no expiry, so they'll never
+            // appear here — leave managed_by as None.
+            managed_by: None,
         })
     }
 }
diff --git a/src/grpc.rs b/src/grpc.rs
index 54a87501..e3ff5426 100644
--- a/src/grpc.rs
+++ b/src/grpc.rs
@@ -13,6 +13,7 @@ use crate::{
     audit,
     auth::{authenticate_token, require_any_capability, scope_for_tenant, AuthContext, Scope},
     authz::{access, engine, repo},
+    callout::{envelope::Actor as CalloutActor, CalloutOutcome, Surface},
     certs,
     identity::service as identity_service,
     models::{
@@ -39,6 +40,74 @@ use proto::{
     RevokeEntityCertificatesResponse,
 };
 
+/// gRPC operation identifiers used by the callout config's `surface: grpc`
+/// entries. Kept as `const` so config typos surface at grep, not runtime.
+mod callout_ops {
+    pub const AUTHZ_CHECK: &str = "atom.v1.AuthzService/Check";
+    pub const AUTH_AUTHENTICATE: &str = "atom.v1.AuthService/Authenticate";
+    pub const AUTH_AUTHENTICATE_CREDENTIAL: &str = "atom.v1.AuthService/AuthenticateCredential";
+    pub const CERT_RESOLVE: &str = "atom.v1.CertificateService/ResolveCertificate";
+    pub const CERT_REVOKE_ENTITY: &str = "atom.v1.CertificateService/RevokeEntityCertificates";
+    pub const ALIAS_RESOLVE: &str = "atom.v1.AliasService/ResolveAlias";
+}
+
+/// Consult the external policy chain for a gRPC method. Returns `Ok(())` on
+/// allow or when no callout is configured. On deny returns
+/// `Status::permission_denied`; on transport failure follows the per-endpoint
+/// `on_error` policy (deny by default). Also writes a `callout.deny` audit row
+/// fire-and-forget for observability.
+async fn callout_check_grpc(
+    state: &AppState,
+    auth: &AuthContext,
+    operation: &'static str,
+    args: serde_json::Value,
+) -> Result<(), Status> {
+    let actor = CalloutActor::from_auth(auth);
+    let outcome = state
+        .callouts
+        .check(Surface::Grpc, operation, actor, args)
+        .await;
+    match outcome {
+        CalloutOutcome::Allow | CalloutOutcome::NotConfigured => Ok(()),
+        CalloutOutcome::Deny {
+            reason,
+            endpoint_id,
+        } => {
+            let pool = state.pool.clone();
+            let actor_id = (!auth.entity_id.is_nil()).then_some(auth.entity_id);
+            let tenant_id = auth.tenant_id;
+            let events_enabled = state.config.events.enabled();
+            let op_name = operation.to_string();
+            let reason_for_audit = reason.clone();
+            let endpoint_for_audit = endpoint_id.clone();
+            tokio::spawn(async move {
+                audit::write(
+                    &pool,
+                    events_enabled,
+                    audit::AuditEvent {
+                        actor_entity_id: actor_id,
+                        tenant_id,
+                        target_kind: Some("callout"),
+                        target_id: None,
+                        event: "callout.deny",
+                        outcome: AuditOutcome::Deny,
+                        details: serde_json::json!({
+                            "operation": op_name,
+                            "surface": "grpc",
+                            "endpoint": endpoint_for_audit,
+                            "reason": reason_for_audit,
+                        }),
+                    },
+                )
+                .await;
+            });
+            Err(Status::permission_denied(format!(
+                "callout denied ({endpoint_id}): {reason}"
+            )))
+        }
+    }
+}
+
 fn authz_request_target(req: &AuthzRequest) -> (Option<&str>, Option<Uuid>) {
     match (req.object_kind.as_deref(), req.object_id) {
         (Some(kind), Some(id)) => (Some(kind), Some(id)),
@@ -102,6 +171,20 @@ impl AuthzService for AtomAuthz {
             context,
         };
 
+        callout_check_grpc(
+            &self.state,
+            &auth,
+            callout_ops::AUTHZ_CHECK,
+            serde_json::json!({
+                "subject_id": authz_req.subject_id,
+                "action": authz_req.action,
+                "resource_id": authz_req.resource_id,
+                "object_kind": authz_req.object_kind,
+                "object_id": authz_req.object_id,
+            }),
+        )
+        .await?;
+
         let tenant_id = access::authz_request_tenant_id(&self.state.pool, &authz_req)
             .await
             .map_err(Status::from)?;
@@ -192,6 +275,16 @@ impl AuthService for AtomAuth {
             .await
             .map_err(Status::from)?;
 
+        // Callout runs post-authn, so the actor block is populated. Token
+        // itself is deliberately not forwarded.
+        callout_check_grpc(
+            &self.state,
+            &ctx,
+            callout_ops::AUTH_AUTHENTICATE,
+            serde_json::json!({}),
+        )
+        .await?;
+
         Ok(Response::new(AuthenticateResponse {
             entity_id: ctx.entity_id.to_string(),
             tenant_id: ctx.tenant_id.map(|t| t.to_string()).unwrap_or_default(),
@@ -223,6 +316,18 @@ impl AuthService for AtomAuth {
 
         require_credential_auth_access(&self.state.pool, &auth, tenant_id).await?;
 
+        callout_check_grpc(
+            &self.state,
+            &auth,
+            callout_ops::AUTH_AUTHENTICATE_CREDENTIAL,
+            serde_json::json!({
+                "identifier": req.identifier,
+                "kind": req.kind,
+                "tenant_id": tenant_id,
+            }),
+        )
+        .await?;
+
         let result = identity_service::authenticate_credential_in_tenant(
             &self.state.pool,
             &self.state.config,
@@ -311,6 +416,16 @@ impl CertificateService for AtomCertificates {
     ) -> Result<Response<ResolveCertificateResponse>, Status> {
         let auth = auth_context_from_metadata(&self.state, request.metadata()).await?;
         let req = request.into_inner();
+        callout_check_grpc(
+            &self.state,
+            &auth,
+            callout_ops::CERT_RESOLVE,
+            serde_json::json!({
+                "serial_number": req.serial_number,
+                "fingerprint_sha256": req.fingerprint_sha256,
+            }),
+        )
+        .await?;
         let identity = certs::service::resolve_certificate_identity(
             &self.state.pool,
             &req.serial_number,
@@ -348,6 +463,16 @@ impl CertificateService for AtomCertificates {
         let req = request.into_inner();
         let entity_id = Uuid::parse_str(&req.entity_id)
             .map_err(|_| Status::invalid_argument("invalid entity_id: expected UUID"))?;
+        callout_check_grpc(
+            &self.state,
+            &auth,
+            callout_ops::CERT_REVOKE_ENTITY,
+            serde_json::json!({
+                "entity_id": entity_id,
+                "reason": req.reason,
+            }),
+        )
+        .await?;
         let tenant_id = certs::repo::entity_tenant_id(&self.state.pool, entity_id)
             .await
             .map_err(Status::from)?;
@@ -412,8 +537,21 @@ impl AliasService for AtomAlias {
     ) -> Result<Response<ResolveAliasResponse>, Status> {
         // Authenticate the caller; resolution itself is capability-neutral — the
         // subsequent AuthzService.Check by UUID is the authorization gate.
-        let _auth = auth_context_from_metadata(&self.state, request.metadata()).await?;
+        let auth = auth_context_from_metadata(&self.state, request.metadata()).await?;
         let req = request.into_inner();
+        callout_check_grpc(
+            &self.state,
+            &auth,
+            callout_ops::ALIAS_RESOLVE,
+            serde_json::json!({
+                "tenant_id": req.tenant_id,
+                "tenant_alias": req.tenant_alias,
+                "global": req.global,
+                "object_kind": req.object_kind,
+                "object_alias": req.object_alias,
+            }),
+        )
+        .await?;
 
         let tenant_id = if req.tenant_id.is_empty() {
             None
diff --git a/src/identity/access_tokens.rs b/src/identity/access_tokens.rs
index ef45fcd8..195fa161 100644
--- a/src/identity/access_tokens.rs
+++ b/src/identity/access_tokens.rs
@@ -179,8 +179,10 @@ pub async fn replace_access_token_permissions_in_tx(
             "access token supports at most {MAX_ACCESS_TOKEN_PERMISSIONS} permissions"
         )));
     }
-    let scoped: Option<bool> = sqlx::query_scalar(
-        r#"SELECT scoped FROM credentials
+    // Look the token up once and reject config-managed rows with a 409
+    // conflict — the same shape as the entity/capability guards.
+    let row: Option<(bool, Option<String>)> = sqlx::query_as(
+        r#"SELECT scoped, managed_by FROM credentials
            WHERE id = $1 AND entity_id = $2 AND kind = $3 AND status = 'active'
            FOR UPDATE"#,
     )
@@ -190,14 +192,19 @@ pub async fn replace_access_token_permissions_in_tx(
     .fetch_optional(&mut **tx)
     .await
     .map_err(db_err)?;
-    match scoped {
+    match row {
         None => return Err(AppError::not_found("access token not found")),
-        Some(false) => {
+        Some((_, Some(mgr))) if mgr == "config" => {
+            return Err(AppError::conflict(
+                "access token is managed by the bootstrap config file and cannot be modified via the API",
+            ))
+        }
+        Some((false, _)) => {
             return Err(AppError::bad_request(
                 "cannot set permissions on an unscoped access token",
             ))
         }
-        Some(true) => {}
+        Some((true, _)) => {}
     }
 
     sqlx::query("DELETE FROM credential_permission_limits WHERE credential_id = $1")
@@ -346,6 +353,9 @@ pub async fn list_access_tokens(
 
     let limit = params.limit.clamp(1, 100);
     let offset = params.offset.max(0);
+    // Config-managed tokens are surfaced with `managed_by='config'` so the
+    // UI can flag them read-only; the mutation endpoints refuse to touch
+    // them with 409 conflict.
     let total: i64 = sqlx::query_scalar(
         r#"SELECT COUNT(*)
            FROM credentials
@@ -369,7 +379,8 @@ pub async fn list_access_tokens(
                   scoped,
                   expires_at,
                   last_used_at,
-                  created_at
+                  created_at,
+                  managed_by
            FROM credentials
            WHERE entity_id = $1
              AND kind = $2
@@ -407,6 +418,7 @@ pub async fn list_access_tokens(
                 expires_at: row.try_get("expires_at").map_err(db_err)?,
                 last_used_at: row.try_get("last_used_at").map_err(db_err)?,
                 created_at: row.try_get("created_at").map_err(db_err)?,
+                managed_by: row.try_get("managed_by").map_err(db_err)?,
             })
         })
         .collect::<Result<Vec<_>, AppError>>()?;
@@ -490,11 +502,35 @@ pub async fn revoke_access_token(
 
 /// See [`create_access_token_in_tx`] — the caller owns the commit so the
 /// revocation and its `credential.revoke` event land atomically.
+///
+/// Bootstrap-provisioned tokens (`managed_by='config'`) are visible via the
+/// list APIs so the UI can flag them read-only, but revoke returns 409
+/// conflict — rotation lives in the YAML.
 pub async fn revoke_access_token_in_tx(
     tx: &mut Transaction<'_, Postgres>,
     entity_id: Uuid,
     cred_id: Uuid,
 ) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> = sqlx::query_scalar(
+        r#"SELECT managed_by FROM credentials
+           WHERE id = $1 AND entity_id = $2 AND kind = $3
+           FOR UPDATE"#,
+    )
+    .bind(cred_id)
+    .bind(entity_id)
+    .bind(CredentialKind::AccessToken)
+    .fetch_optional(&mut **tx)
+    .await
+    .map_err(db_err)?;
+    match managed_by {
+        None => return Err(AppError::not_found("access token not found")),
+        Some(Some(value)) if value == "config" => {
+            return Err(AppError::conflict(
+                "access token is managed by the bootstrap config file and cannot be revoked via the API",
+            ))
+        }
+        _ => {}
+    }
     let result = sqlx::query(
         r#"UPDATE credentials
            SET status = 'revoked',
diff --git a/src/identity/repo.rs b/src/identity/repo.rs
index 24a9dfbd..d433f608 100644
--- a/src/identity/repo.rs
+++ b/src/identity/repo.rs
@@ -18,6 +18,53 @@ use crate::{
 
 pub const AUTHENTICATED_USERS_GROUP_ID: Uuid = Uuid::from_u128(5);
 
+/// Refuse mutations against an entity provisioned from the bootstrap config
+/// file. Config-managed entities can only be reshaped by editing the YAML and
+/// restarting Atom, so all API-facing update/delete/restore paths funnel
+/// through this guard.
+pub async fn ensure_not_config_managed_entity(pool: &PgPool, id: Uuid) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> =
+        sqlx::query_scalar("SELECT managed_by FROM entities WHERE id = $1")
+            .bind(id)
+            .fetch_optional(pool)
+            .await
+            .map_err(db_err)?;
+    match managed_by {
+        None => Err(AppError::not_found(format!("entity {id} not found"))),
+        Some(Some(value)) if value == "config" => Err(AppError::conflict(
+            "entity is managed by the bootstrap config file and cannot be modified via the API",
+        )),
+        _ => Ok(()),
+    }
+}
+
+/// Companion for credential mutations. Config-managed credentials are visible
+/// in list/read responses (so the UI can flag them read-only), but mutation
+/// endpoints (revoke, replace ceiling) reject them with 409 conflict so the
+/// operator's declared row can only be reshaped by editing the YAML.
+///
+/// `reveal_shared_key` uses a different guard — it must not return the
+/// plaintext key of a config-managed row and returns not_found instead, per
+/// its own module.
+pub async fn ensure_not_config_managed_credential(
+    pool: &PgPool,
+    cred_id: Uuid,
+) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> =
+        sqlx::query_scalar("SELECT managed_by FROM credentials WHERE id = $1")
+            .bind(cred_id)
+            .fetch_optional(pool)
+            .await
+            .map_err(db_err)?;
+    match managed_by {
+        None => Err(AppError::not_found("credential not found")),
+        Some(Some(value)) if value == "config" => Err(AppError::conflict(
+            "credential is managed by the bootstrap config file and cannot be modified via the API",
+        )),
+        _ => Ok(()),
+    }
+}
+
 pub async fn lock_active_entity(
     tx: &mut Transaction<'_, Postgres>,
     id: Uuid,
@@ -79,7 +126,7 @@ pub async fn create_entity_with_audit(
            (id, kind, name, alias, tenant_id, profile_id, profile_version_id, attributes)
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
            RETURNING id, kind, name, alias, tenant_id, profile_id, profile_version_id,
-                     status, attributes, deleted_at, deleted_by, created_at, updated_at"#,
+                     status, attributes, deleted_at, deleted_by, created_at, updated_at, managed_by"#,
     )
     .bind(id)
     .bind(kind)
@@ -150,7 +197,7 @@ where
 {
     sqlx::query_as::<_, Entity>(
         r#"SELECT id, kind, name, alias, tenant_id, profile_id, profile_version_id,
-                  status, attributes, deleted_at, deleted_by, created_at, updated_at
+                  status, attributes, deleted_at, deleted_by, created_at, updated_at, managed_by
            FROM entities
            WHERE id = $1 AND deleted_at IS NULL"#,
     )
@@ -170,7 +217,7 @@ pub async fn list_entities_by_ids(pool: &PgPool, ids: &[Uuid]) -> Result<Vec<Ent
 
     sqlx::query_as::<_, Entity>(
         r#"SELECT id, kind, name, alias, tenant_id, profile_id, profile_version_id,
-                  status, attributes, deleted_at, deleted_by, created_at, updated_at
+                  status, attributes, deleted_at, deleted_by, created_at, updated_at, managed_by
            FROM entities
            WHERE id = ANY($1::uuid[]) AND deleted_at IS NULL
            ORDER BY array_position($1::uuid[], id)"#,
@@ -278,6 +325,7 @@ pub async fn update_entity_with_audit(
     event_name: &str,
     audit_details: Value,
 ) -> Result<Entity, AppError> {
+    ensure_not_config_managed_entity(pool, id).await?;
     let attributes = req.attributes.clone().map(normalize_attributes);
     let parent_group_id = attributes
         .as_ref()
@@ -339,7 +387,7 @@ pub async fn update_entity_with_audit(
                updated_at         = now()
            WHERE id = $1 AND deleted_at IS NULL
            RETURNING id, kind, name, alias, tenant_id, profile_id, profile_version_id,
-                     status, attributes, deleted_at, deleted_by, created_at, updated_at"#,
+                     status, attributes, deleted_at, deleted_by, created_at, updated_at, managed_by"#,
     )
     .bind(id)
     .bind(req.name)
@@ -707,6 +755,7 @@ pub async fn delete_entity_with_audit(
     id: Uuid,
     deleted_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    ensure_not_config_managed_entity(pool, id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
     let tenant_id: Option<Option<Uuid>> =
@@ -802,6 +851,7 @@ pub async fn restore_entity_with_audit(
     id: Uuid,
     restored_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    ensure_not_config_managed_entity(pool, id).await?;
     let _ = restored_by;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
@@ -1110,7 +1160,7 @@ where
 {
     sqlx::query_as::<_, Group>(
         r#"SELECT g.id, g.name, g.tenant_id, g.group_type, g.description, gh.parent_id,
-                  g.status, g.attributes, g.deleted_at, g.deleted_by, g.created_at, g.updated_at
+                  g.status, g.attributes, g.deleted_at, g.deleted_by, g.created_at, g.updated_at, g.managed_by
            FROM groups g
            LEFT JOIN group_hierarchy gh ON gh.child_id = g.id
            WHERE g.id = $1 AND g.deleted_at IS NULL"#,
@@ -1131,7 +1181,7 @@ pub async fn list_groups_by_ids(pool: &PgPool, ids: &[Uuid]) -> Result<Vec<Group
 
     sqlx::query_as::<_, Group>(
         r#"SELECT g.id, g.name, g.tenant_id, g.group_type, g.description, gh.parent_id,
-                  g.status, g.attributes, g.deleted_at, g.deleted_by, g.created_at, g.updated_at
+                  g.status, g.attributes, g.deleted_at, g.deleted_by, g.created_at, g.updated_at, g.managed_by
            FROM groups g
            LEFT JOIN group_hierarchy gh ON gh.child_id = g.id
            WHERE g.id = ANY($1::uuid[]) AND g.deleted_at IS NULL
@@ -1153,7 +1203,7 @@ pub async fn list_groups(pool: &PgPool, params: ListGroups) -> Result<GroupList,
 
     let items = sqlx::query_as::<_, Group>(
         r#"SELECT g.id, g.name, g.tenant_id, g.group_type, g.description, gh.parent_id,
-                  g.status, g.attributes, g.deleted_at, g.deleted_by, g.created_at, g.updated_at
+                  g.status, g.attributes, g.deleted_at, g.deleted_by, g.created_at, g.updated_at, g.managed_by
            FROM groups g
            LEFT JOIN group_hierarchy gh ON gh.child_id = g.id
            WHERE ($1::uuid IS NULL OR g.tenant_id = $1)
@@ -1471,6 +1521,7 @@ pub async fn update_group_with_audit(
     event_name: &str,
     audit_details: Value,
 ) -> Result<Group, AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "groups", id).await?;
     let attributes = req.attributes.clone().map(normalize_attributes);
     let mut tx = pool.begin().await.map_err(db_err)?;
     let tenant_id: Option<Option<Uuid>> =
@@ -1556,6 +1607,7 @@ pub async fn delete_group_with_audit(
     id: Uuid,
     deleted_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "groups", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
     let tenant_id: Option<Option<Uuid>> =
         sqlx::query_scalar("SELECT tenant_id FROM groups WHERE id = $1 AND deleted_at IS NULL")
@@ -1616,6 +1668,7 @@ pub async fn restore_group_with_audit(
     id: Uuid,
     restored_by: Option<Uuid>,
 ) -> Result<(), AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "groups", id).await?;
     let _ = restored_by;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
diff --git a/src/identity/service.rs b/src/identity/service.rs
index efd9f2ce..2ea62286 100644
--- a/src/identity/service.rs
+++ b/src/identity/service.rs
@@ -2116,6 +2116,20 @@ pub async fn reveal_shared_key(
 ) -> Result<SharedKeyResponse, AppError> {
     use sqlx::Row;
 
+    // Reveal exposes the plaintext key. Config-managed rows must never leak
+    // that material, so this endpoint (unlike revoke) returns not_found for
+    // config-managed rows — even the existence of the credential must not be
+    // acknowledged through the reveal path.
+    let managed_by: Option<Option<String>> =
+        sqlx::query_scalar("SELECT managed_by FROM credentials WHERE id = $1")
+            .bind(credential_id)
+            .fetch_optional(pool)
+            .await
+            .map_err(db_err)?;
+    if !matches!(managed_by, Some(None)) {
+        return Err(AppError::not_found("shared key not found"));
+    }
+
     let row = sqlx::query(
         r#"SELECT c.expires_at,
                   c.status,
@@ -2249,11 +2263,32 @@ pub async fn revoke_credential(
 
 /// See [`create_password_in_tx`] — the caller owns the commit so the revocation
 /// and its domain event land atomically.
+///
+/// Config-managed credentials (`managed_by='config'`) are visible via the
+/// list APIs so the UI can flag them read-only; this mutation refuses with
+/// 409 conflict so rotation stays in the YAML.
 pub async fn revoke_credential_in_tx(
     tx: &mut Transaction<'_, Postgres>,
     entity_id: Uuid,
     cred_id: Uuid,
 ) -> Result<(), AppError> {
+    let managed_by: Option<Option<String>> = sqlx::query_scalar(
+        "SELECT managed_by FROM credentials
+         WHERE id = $1 AND entity_id = $2
+         FOR UPDATE",
+    )
+    .bind(cred_id)
+    .bind(entity_id)
+    .fetch_optional(&mut **tx)
+    .await
+    .map_err(db_err)?;
+    match managed_by {
+        None => return Err(AppError::not_found("credential not found")),
+        Some(Some(value)) if value == "config" => return Err(AppError::conflict(
+            "credential is managed by the bootstrap config file and cannot be revoked via the API",
+        )),
+        _ => {}
+    }
     // Overwrite any prior revocation provenance (e.g. a `tenant_deleted` marker
     // from a tenant soft delete) with this explicit revocation, so a later tenant
     // restore — which only reactivates credentials still marked `tenant_deleted` —
@@ -2285,8 +2320,16 @@ pub async fn list_credentials(
 ) -> Result<Vec<CredentialSummary>, AppError> {
     use sqlx::Row;
 
+    // Config-managed credentials are surfaced with `managed_by='config'` so
+    // the UI can flag them read-only. The metadata below carries no secret
+    // material. Mutation endpoints (revoke/reveal/replace) still refuse to
+    // touch them, and `reveal_shared_key` in particular refuses to read the
+    // plaintext key out of a config-managed row.
     let rows = sqlx::query(
-        "SELECT id, kind, identifier, status, expires_at, created_at FROM credentials WHERE entity_id = $1 ORDER BY created_at DESC",
+        "SELECT id, kind, identifier, status, expires_at, created_at, managed_by
+         FROM credentials
+         WHERE entity_id = $1
+         ORDER BY created_at DESC",
     )
     .bind(entity_id)
     .fetch_all(pool)
@@ -2303,6 +2346,7 @@ pub async fn list_credentials(
                 status: r.try_get("status").map_err(db_err)?,
                 expires_at: r.try_get("expires_at").map_err(db_err)?,
                 created_at: r.try_get("created_at").map_err(db_err)?,
+                managed_by: r.try_get("managed_by").map_err(db_err)?,
             })
         })
         .collect::<Result<Vec<_>, AppError>>()?;
@@ -2318,4 +2362,5 @@ pub struct CredentialSummary {
     pub status: CredentialStatus,
     pub expires_at: Option<chrono::DateTime<Utc>>,
     pub created_at: chrono::DateTime<Utc>,
+    pub managed_by: Option<String>,
 }
diff --git a/src/lib.rs b/src/lib.rs
index 5da29224..084f91c4 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,7 +8,9 @@ pub mod api_endpoints;
 pub mod audit;
 pub mod auth;
 pub mod authz;
+pub mod bootstrap;
 pub mod build_info;
+pub mod callout;
 pub mod certs;
 pub mod config;
 pub mod crypto;
@@ -22,6 +24,7 @@ pub mod health;
 pub mod identity;
 pub mod keys;
 pub mod mail;
+pub mod managed_by;
 pub mod metrics;
 pub mod models;
 pub mod purge;
diff --git a/src/main.rs b/src/main.rs
index 06916f4b..60c647a9 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,6 +1,7 @@
 use anyhow::Context;
 use atom::{
-    audit, certs, config, db, events, grpc, identity, keys, metrics, purge, routes,
+    audit, bootstrap, callout, certs, config, db, events, grpc, identity, keys, metrics, purge,
+    routes,
     state::{self, GrpcRuntimeStatus},
 };
 use tracing_subscriber::EnvFilter;
@@ -31,6 +32,12 @@ async fn main() -> anyhow::Result<()> {
         bootstrap_password_credentials(&pool, cfg.service_entity_id, secret, "service").await?;
     }
 
+    if let Some(ref path) = cfg.bootstrap_file {
+        let bootstrap_cfg = bootstrap::load(std::path::Path::new(path))?;
+        bootstrap::apply(&pool, &cfg.signing_keys, &bootstrap_cfg).await?;
+        tracing::info!("bootstrap file applied: {path}");
+    }
+
     keys::bootstrap_if_needed(&pool, &cfg.signing_keys).await?;
     let certificate_issuer = certs::service::load_file_issuer_if_enabled(&cfg)?;
     let active_keys = keys::load_active_keys(&pool, &cfg.signing_keys).await?;
@@ -44,7 +51,11 @@ async fn main() -> anyhow::Result<()> {
     // startup instead of leaving HTTP up with a permanently failing gRPC task.
     let grpc_tls = grpc::load_tls_config(&cfg).await?;
 
-    let mut state = state::AppState::new(pool, cfg.clone(), active_keys, certificate_issuer);
+    let callouts_config = callout::CalloutsConfig::load_from_env().await?;
+    let callout_service = callout::CalloutService::build(callouts_config).await?;
+
+    let mut state = state::AppState::new(pool, cfg.clone(), active_keys, certificate_issuer)
+        .with_callouts(callout_service);
     if cfg.events.enabled() {
         let publisher = events::publisher::AmqpPublisher::connect(&cfg.events)
             .await
diff --git a/src/managed_by.rs b/src/managed_by.rs
new file mode 100644
index 00000000..e032267b
--- /dev/null
+++ b/src/managed_by.rs
@@ -0,0 +1,75 @@
+//! Shared guard used by mutation endpoints to refuse writes on rows the
+//! bootstrap YAML claimed (rows with `managed_by='config'`). Colocated here
+//! so every module that mutates a bootstrap-touched table can call the same
+//! helper — see `src/bootstrap.rs::stamp_managed_by_config` for the write
+//! side of the same marker.
+//!
+//! The table name is looked up in a closed static match, not interpolated,
+//! so a caller cannot inject arbitrary SQL.
+
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::error::{db_err, AppError};
+
+/// Reject a mutation attempt on a row that was provisioned from the bootstrap
+/// YAML. Returns:
+///
+/// - `Ok(())` — the row does not exist yet OR is API-managed (`managed_by IS NULL`).
+/// - `Err(AppError::not_found)` — the row does not exist.
+/// - `Err(AppError::conflict)` — the row is stamped `managed_by='config'`;
+///   the operator must edit the YAML and restart Atom.
+pub async fn ensure_not_config_managed(
+    pool: &PgPool,
+    table: &'static str,
+    id: Uuid,
+) -> Result<(), AppError> {
+    let sql = match table {
+        "tenants" => "SELECT managed_by FROM tenants WHERE id = $1",
+        "resources" => "SELECT managed_by FROM resources WHERE id = $1",
+        "principal_groups" => "SELECT managed_by FROM principal_groups WHERE id = $1",
+        "object_groups" => "SELECT managed_by FROM object_groups WHERE id = $1",
+        // The `groups` view unions principal_groups + object_groups. Group
+        // mutations don't know upfront which underlying table an id belongs
+        // to, so lookups go through the view.
+        "groups" => "SELECT managed_by FROM groups WHERE id = $1",
+        "roles" => "SELECT managed_by FROM roles WHERE id = $1",
+        "permission_blocks" => "SELECT managed_by FROM permission_blocks WHERE id = $1",
+        "role_assignments" => "SELECT managed_by FROM role_assignments WHERE id = $1",
+        "direct_policies" => "SELECT managed_by FROM direct_policies WHERE id = $1",
+        _ => {
+            return Err(AppError::Internal(anyhow::anyhow!(
+                "ensure_not_config_managed called with unknown table {table}"
+            )))
+        }
+    };
+    let managed_by: Option<Option<String>> = sqlx::query_scalar(sql)
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+        .map_err(db_err)?;
+    match managed_by {
+        None => Err(AppError::not_found(format!(
+            "{singular} {id} not found",
+            singular = singular(table),
+        ))),
+        Some(Some(value)) if value == "config" => Err(AppError::conflict(format!(
+            "{singular} is managed by the bootstrap config file and cannot be modified via the API",
+            singular = singular(table),
+        ))),
+        _ => Ok(()),
+    }
+}
+
+fn singular(table: &str) -> &'static str {
+    match table {
+        "tenants" => "tenant",
+        "resources" => "resource",
+        "principal_groups" | "object_groups" | "groups" => "group",
+        "roles" => "role",
+        "permission_blocks" => "permission block",
+        "role_assignments" => "role assignment",
+        "direct_policies" => "direct policy",
+        _ => "row",
+    }
+}
diff --git a/src/metrics.rs b/src/metrics.rs
index f99137fd..0f723998 100644
--- a/src/metrics.rs
+++ b/src/metrics.rs
@@ -36,6 +36,11 @@ pub const EVENT_OUTBOX_PUBLISH_FAILURES: &str = "atom_event_outbox_publish_failu
 pub const EVENT_OUTBOX_EXHAUSTED: &str = "atom_event_outbox_exhausted_total";
 /// Gauge of DB pool connections, labelled by `state` (total|idle).
 pub const DB_POOL_CONNECTIONS: &str = "atom_db_pool_connections";
+/// Counter of callout attempts, labelled by `operation`, `endpoint`,
+/// `transport`, and `result` (allow|deny|transport_error|timeout).
+pub const CALLOUT_CALLS: &str = "atom_callout_calls_total";
+/// Histogram (seconds) of end-to-end callout latency per endpoint.
+pub const CALLOUT_DURATION: &str = "atom_callout_call_duration_seconds";
 
 #[cfg(feature = "metrics")]
 mod backend {
@@ -102,6 +107,32 @@ mod backend {
     pub fn record_outbox_exhausted() {
         metrics::counter!(EVENT_OUTBOX_EXHAUSTED).increment(1);
     }
+
+    pub fn record_callout(
+        operation: &str,
+        endpoint: &str,
+        transport: &'static str,
+        result: &'static str,
+        elapsed: Duration,
+    ) {
+        // Operation and endpoint labels are bounded by the callout config
+        // (finite, operator-controlled) — safe as high-cardinality labels.
+        metrics::counter!(
+            CALLOUT_CALLS,
+            "operation" => operation.to_string(),
+            "endpoint" => endpoint.to_string(),
+            "transport" => transport,
+            "result" => result,
+        )
+        .increment(1);
+        metrics::histogram!(
+            CALLOUT_DURATION,
+            "operation" => operation.to_string(),
+            "endpoint" => endpoint.to_string(),
+            "transport" => transport,
+        )
+        .record(elapsed.as_secs_f64());
+    }
 }
 
 #[cfg(not(feature = "metrics"))]
@@ -130,9 +161,19 @@ mod backend {
     pub fn record_outbox_publish_failure(_rows: u64) {}
     #[inline]
     pub fn record_outbox_exhausted() {}
+    #[inline]
+    pub fn record_callout(
+        _operation: &str,
+        _endpoint: &str,
+        _transport: &'static str,
+        _result: &'static str,
+        _elapsed: Duration,
+    ) {
+    }
 }
 
 pub use backend::{
-    enabled, init, record_audit_db_suppressed, record_audit_failure, record_decision,
-    record_outbox_exhausted, record_outbox_publish_failure, record_rate_limit_rejection, render,
+    enabled, init, record_audit_db_suppressed, record_audit_failure, record_callout,
+    record_decision, record_outbox_exhausted, record_outbox_publish_failure,
+    record_rate_limit_rejection, render,
 };
diff --git a/src/models/action_assignment_rule.rs b/src/models/action_assignment_rule.rs
index e8a194a7..7f36b2d1 100644
--- a/src/models/action_assignment_rule.rs
+++ b/src/models/action_assignment_rule.rs
@@ -15,6 +15,11 @@ pub struct ActionAssignmentRule {
     pub decision: ActionAssignmentDecision,
     pub is_absolute: bool,
     pub created_at: DateTime<Utc>,
+    /// `Some("config")` when provisioned from the bootstrap YAML. The UI
+    /// uses this to render the row read-only; the API rejects delete with
+    /// 409 conflict.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
diff --git a/src/models/capability.rs b/src/models/capability.rs
index 82a2b3c1..01e16048 100644
--- a/src/models/capability.rs
+++ b/src/models/capability.rs
@@ -9,12 +9,19 @@ pub struct Capability {
     pub description: Option<String>,
     pub created_at: DateTime<Utc>,
     pub updated_at: Option<DateTime<Utc>>,
+    /// `Some("config")` when provisioned from the bootstrap YAML. The UI
+    /// uses this to render the row read-only; the API rejects update/delete
+    /// with 409 conflict.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
 pub struct CapabilityApplicability {
     pub object_kind: String,
     pub object_type: Option<String>,
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
@@ -25,6 +32,8 @@ pub struct CapabilityApplicabilityEntry {
     pub object_kind: String,
     pub object_type: Option<String>,
     pub created_at: DateTime<Utc>,
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
diff --git a/src/models/entity.rs b/src/models/entity.rs
index 83251bb6..d7c98395 100644
--- a/src/models/entity.rs
+++ b/src/models/entity.rs
@@ -20,6 +20,14 @@ pub struct Entity {
     pub deleted_by: Option<Uuid>,
     pub created_at: DateTime<Utc>,
     pub updated_at: Option<DateTime<Utc>>,
+    /// `Some("config")` when the row was provisioned from the bootstrap YAML
+    /// (see src/bootstrap.rs). The API rejects update/delete/restore of these
+    /// rows with 409 conflict; the UI uses this flag to render them read-only.
+    /// Marked `sqlx(default)` so RETURNING / older SELECTs that omit the
+    /// column still hydrate cleanly — the read paths that surface this to the
+    /// UI explicitly include it.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
diff --git a/src/models/group.rs b/src/models/group.rs
index af20b1e3..aa884ec0 100644
--- a/src/models/group.rs
+++ b/src/models/group.rs
@@ -19,6 +19,9 @@ pub struct Group {
     pub deleted_by: Option<Uuid>,
     pub created_at: DateTime<Utc>,
     pub updated_at: Option<DateTime<Utc>>,
+    /// `Some("config")` when provisioned from the bootstrap YAML.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
diff --git a/src/models/policy.rs b/src/models/policy.rs
index 3c8aa193..8bfece40 100644
--- a/src/models/policy.rs
+++ b/src/models/policy.rs
@@ -34,6 +34,9 @@ pub struct PermissionBlock {
     pub conditions: Value,
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,
+    /// `Some("config")` when provisioned from the bootstrap YAML.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
@@ -71,6 +74,9 @@ pub struct RoleAssignment {
     pub subject_id: Uuid,
     pub role_id: Uuid,
     pub created_at: DateTime<Utc>,
+    /// `Some("config")` when provisioned from the bootstrap YAML.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
@@ -105,6 +111,9 @@ pub struct DirectPolicy {
     pub subject_id: Uuid,
     pub permission_block_id: Uuid,
     pub created_at: DateTime<Utc>,
+    /// `Some("config")` when provisioned from the bootstrap YAML.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
diff --git a/src/models/resource.rs b/src/models/resource.rs
index fb5d1c57..52d8414c 100644
--- a/src/models/resource.rs
+++ b/src/models/resource.rs
@@ -18,6 +18,9 @@ pub struct Resource {
     pub deleted_by: Option<Uuid>,
     pub created_at: DateTime<Utc>,
     pub updated_at: Option<DateTime<Utc>>,
+    /// `Some("config")` when provisioned from the bootstrap YAML.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
diff --git a/src/models/role.rs b/src/models/role.rs
index 2d64a3ce..88df72ab 100644
--- a/src/models/role.rs
+++ b/src/models/role.rs
@@ -14,6 +14,9 @@ pub struct Role {
     pub deleted_by: Option<Uuid>,
     pub created_at: DateTime<Utc>,
     pub updated_at: Option<DateTime<Utc>>,
+    /// `Some("config")` when provisioned from the bootstrap YAML.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
diff --git a/src/models/tenant.rs b/src/models/tenant.rs
index 9d8a257c..eafe9ed1 100644
--- a/src/models/tenant.rs
+++ b/src/models/tenant.rs
@@ -19,6 +19,11 @@ pub struct Tenant {
     pub deleted_by: Option<Uuid>,
     pub created_at: DateTime<Utc>,
     pub updated_at: Option<DateTime<Utc>>,
+    /// `Some("config")` when provisioned from the bootstrap YAML. The API
+    /// rejects update/restore with 409 conflict; the UI renders the row
+    /// read-only.
+    #[sqlx(default)]
+    pub managed_by: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
diff --git a/src/models/token.rs b/src/models/token.rs
index 51a913e4..b921311c 100644
--- a/src/models/token.rs
+++ b/src/models/token.rs
@@ -44,6 +44,10 @@ pub struct AccessTokenSummary {
     /// granularity. `None` = never used.
     pub last_used_at: Option<DateTime<Utc>>,
     pub created_at: DateTime<Utc>,
+    /// `Some("config")` when provisioned from the bootstrap YAML. The UI
+    /// renders these read-only; the API rejects revoke and permission-replace
+    /// with 409 conflict.
+    pub managed_by: Option<String>,
 }
 
 /// A ceiling entry rendered for display in the token list.
diff --git a/src/state.rs b/src/state.rs
index 772a4d89..bbcafe8c 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -3,8 +3,8 @@ use std::sync::Arc;
 use tokio::sync::RwLock;
 
 use crate::{
-    certs::service::CertificateIssuer, config::Config, events::publisher::EventPublisher,
-    keys::ActiveKeys, rate_limit::RateLimiter,
+    callout::CalloutService, certs::service::CertificateIssuer, config::Config,
+    events::publisher::EventPublisher, keys::ActiveKeys, rate_limit::RateLimiter,
 };
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -62,6 +62,10 @@ pub struct AppState {
     /// Set via [`AppState::with_event_publisher`], since connecting to a
     /// broker is an async operation `AppState::new` (sync) can't perform.
     pub event_publisher: Option<Arc<dyn EventPublisher>>,
+    /// Callout service — dispatches per-op callouts to configured external
+    /// policy endpoints. When callouts are disabled or unconfigured, this is
+    /// a cheap no-op ([`CalloutService::disabled`]).
+    pub callouts: CalloutService,
     grpc_status: Arc<RwLock<GrpcRuntimeStatus>>,
 }
 
@@ -80,6 +84,7 @@ impl AppState {
             certificate_issuer: certificate_issuer.map(Arc::new),
             rate_limiter: Arc::new(RateLimiter::default()),
             event_publisher: None,
+            callouts: CalloutService::disabled(),
             grpc_status: Arc::new(RwLock::new(grpc_status)),
         }
     }
@@ -92,6 +97,14 @@ impl AppState {
         self
     }
 
+    /// Installs a built callout service (built in `main.rs` because endpoint
+    /// setup — TLS/mTLS load, gRPC connect — is async). Defaults to
+    /// [`CalloutService::disabled`] when unset.
+    pub fn with_callouts(mut self, callouts: CalloutService) -> Self {
+        self.callouts = callouts;
+        self
+    }
+
     pub async fn grpc_status(&self) -> GrpcRuntimeStatus {
         self.grpc_status.read().await.clone()
     }
diff --git a/src/tenants/repo.rs b/src/tenants/repo.rs
index 99816f96..d3b92093 100644
--- a/src/tenants/repo.rs
+++ b/src/tenants/repo.rs
@@ -18,7 +18,7 @@ use crate::{
 };
 
 const TENANT_COLS: &str =
-    "id, name, alias, status, tags, attributes, created_by, updated_by, deleted_at, deleted_by, created_at, updated_at";
+    "id, name, alias, status, tags, attributes, created_by, updated_by, deleted_at, deleted_by, created_at, updated_at, managed_by";
 const INVITATION_COLS: &str =
     "ti.id, ti.tenant_id, ti.invitee_user_id, e.name AS invitee_name, ti.invitee_email, ti.invited_by,
      ti.role_id, r.name AS role_name, ti.accepted_at, ti.rejected_at,
@@ -497,6 +497,7 @@ pub async fn update_tenant_with_audit(
     req: UpdateTenant,
     updated_by: Option<Uuid>,
 ) -> Result<Tenant, AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "tenants", id).await?;
     let alias = crate::models::alias::validate_alias_update(req.alias)?;
     let alias_is_set = alias.is_some();
     let alias = alias.flatten();
@@ -554,6 +555,7 @@ pub async fn soft_delete_tenant_with_audit(
     id: Uuid,
     deleted_by: Option<Uuid>,
 ) -> Result<Tenant, AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "tenants", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
     let tenant = sqlx::query_as::<_, Tenant>(&format!(
@@ -633,6 +635,7 @@ pub async fn restore_tenant_with_audit(
     id: Uuid,
     restored_by: Option<Uuid>,
 ) -> Result<Tenant, AppError> {
+    crate::managed_by::ensure_not_config_managed(pool, "tenants", id).await?;
     let mut tx = pool.begin().await.map_err(db_err)?;
 
     let tenant = sqlx::query_as::<_, Tenant>(&format!(
diff --git a/tests/m13_graphql_authz_admin.rs b/tests/m13_graphql_authz_admin.rs
index 8c852d30..73e4cd4c 100644
--- a/tests/m13_graphql_authz_admin.rs
+++ b/tests/m13_graphql_authz_admin.rs
@@ -109,6 +109,19 @@ async fn channel(pool: &PgPool) -> Uuid {
     .execute(pool)
     .await
     .expect("insert channel");
+    // `publish`/`subscribe` applicability on `resource:channel` is now
+    // product-specific and provisioned via the deployment bootstrap YAML;
+    // tests that model a channel need to declare it inline so the guardrail
+    // check on `createPermissionBlock` passes.
+    sqlx::query(
+        r#"INSERT INTO action_applicability (action_id, object_kind, object_type)
+           SELECT id, 'resource', 'resource:channel'
+             FROM actions WHERE name IN ('publish', 'subscribe')
+           ON CONFLICT DO NOTHING"#,
+    )
+    .execute(pool)
+    .await
+    .expect("seed channel applicability");
     id
 }
 
diff --git a/tests/m25_config_bootstrap.rs b/tests/m25_config_bootstrap.rs
new file mode 100644
index 00000000..4b5dec35
--- /dev/null
+++ b/tests/m25_config_bootstrap.rs
@@ -0,0 +1,537 @@
+//! Config-file bootstrap integration tests (issue #27).
+//!
+//! Run with:
+//! ```bash
+//! DATABASE_URL=postgres://... cargo test --test m25_config_bootstrap -- --ignored
+//! ```
+
+mod common;
+
+use atom::bootstrap::{
+    apply, BootstrapCapability, BootstrapCapabilityApplicability, BootstrapConfig,
+    BootstrapCredential, BootstrapDirectPolicy, BootstrapEntity, BootstrapGroup,
+    BootstrapObjectGroup, BootstrapPermissionBlock, BootstrapResource, BootstrapRole,
+    BootstrapRoleAssignment, BootstrapScope, BootstrapSubject, BootstrapTenant, ScopeMode,
+};
+use atom::config::Config;
+use atom::models::enums::{EntityKind, EntityStatus, ObjectKind, SubjectKind, TenantStatus};
+use atom::models::policy::AuthzRequest;
+use common::pool;
+use serde_json::json;
+use uuid::Uuid;
+
+async fn count_active_credentials(pool: &sqlx::PgPool, entity_id: Uuid, kind: &str) -> i64 {
+    sqlx::query_scalar(
+        "SELECT COUNT(*) FROM credentials WHERE entity_id = $1 AND kind = $2 AND status = 'active'",
+    )
+    .bind(entity_id)
+    .bind(kind)
+    .fetch_one(pool)
+    .await
+    .expect("count credentials")
+}
+
+fn credentials_config(human: Uuid, service: Uuid) -> BootstrapConfig {
+    BootstrapConfig {
+        entities: vec![
+            BootstrapEntity {
+                id: human,
+                kind: EntityKind::Human,
+                name: format!("bootstrap-human-{human}"),
+                alias: None,
+                status: EntityStatus::Active,
+                attributes: Some(serde_json::json!({ "system": true })),
+                tenant_id: None,
+                credentials: vec![BootstrapCredential::Password {
+                    secret: "bootstrap-pw-123456".to_string(),
+                }],
+            },
+            BootstrapEntity {
+                id: service,
+                kind: EntityKind::Service,
+                name: format!("bootstrap-service-{service}"),
+                alias: None,
+                status: EntityStatus::Active,
+                attributes: None,
+                tenant_id: None,
+                credentials: vec![BootstrapCredential::SharedKey {
+                    key: "bootstrap-machine-secret".to_string(),
+                    description: Some("integration test".to_string()),
+                }],
+            },
+        ],
+        ..Default::default()
+    }
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_creates_entities_and_credentials() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let human = Uuid::new_v4();
+    let service = Uuid::new_v4();
+    let cfg = credentials_config(human, service);
+
+    apply(&p, &signing_keys, &cfg)
+        .await
+        .expect("apply bootstrap");
+
+    let human_kind: String = sqlx::query_scalar("SELECT kind FROM entities WHERE id = $1")
+        .bind(human)
+        .fetch_one(&p)
+        .await
+        .expect("human entity exists");
+    assert_eq!(human_kind, "human");
+
+    let service_kind: String = sqlx::query_scalar("SELECT kind FROM entities WHERE id = $1")
+        .bind(service)
+        .fetch_one(&p)
+        .await
+        .expect("service entity exists");
+    assert_eq!(service_kind, "service");
+
+    assert_eq!(count_active_credentials(&p, human, "password").await, 1);
+    assert_eq!(count_active_credentials(&p, service, "shared_key").await, 1);
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_is_idempotent() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let human = Uuid::new_v4();
+    let service = Uuid::new_v4();
+    let cfg = credentials_config(human, service);
+
+    // Apply twice; the second run must not create duplicate rows.
+    apply(&p, &signing_keys, &cfg).await.expect("first apply");
+    apply(&p, &signing_keys, &cfg).await.expect("second apply");
+
+    let entity_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM entities WHERE id = $1")
+        .bind(human)
+        .fetch_one(&p)
+        .await
+        .expect("count human");
+    assert_eq!(entity_count, 1);
+
+    assert_eq!(count_active_credentials(&p, human, "password").await, 1);
+    assert_eq!(count_active_credentials(&p, service, "shared_key").await, 1);
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_does_not_clobber_existing_credentials() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let human = Uuid::new_v4();
+    let service = Uuid::new_v4();
+
+    apply(&p, &signing_keys, &credentials_config(human, service))
+        .await
+        .expect("first apply");
+
+    let original_hash: String =
+        sqlx::query_scalar("SELECT secret_hash FROM credentials WHERE entity_id = $1")
+            .bind(human)
+            .fetch_one(&p)
+            .await
+            .expect("password hash");
+
+    // A second run declaring a different secret for the same entity must not
+    // rotate the existing credential — bootstrap only fills in what is missing.
+    let mut changed = credentials_config(human, service);
+    changed.entities[0].credentials = vec![BootstrapCredential::Password {
+        secret: "a-totally-different-secret".to_string(),
+    }];
+    apply(&p, &signing_keys, &changed)
+        .await
+        .expect("second apply");
+
+    let after_hash: String =
+        sqlx::query_scalar("SELECT secret_hash FROM credentials WHERE entity_id = $1")
+            .bind(human)
+            .fetch_one(&p)
+            .await
+            .expect("password hash after");
+    assert_eq!(
+        original_hash, after_hash,
+        "existing password must be preserved"
+    );
+    assert_eq!(count_active_credentials(&p, human, "password").await, 1);
+}
+
+/// A full tenant → entity → block → role → assignment graph, ending in a real
+/// PDP-visible grant for the assigned entity.
+fn rbac_config(
+    tenant: Uuid,
+    device: Uuid,
+    block: Uuid,
+    role: Uuid,
+    assignment: Uuid,
+) -> BootstrapConfig {
+    BootstrapConfig {
+        tenants: vec![BootstrapTenant {
+            id: tenant,
+            name: format!("bootstrap-tenant-{tenant}"),
+            alias: None,
+            tags: vec!["demo".to_string()],
+            attributes: None,
+            status: TenantStatus::Active,
+        }],
+        entities: vec![BootstrapEntity {
+            id: device,
+            kind: EntityKind::Device,
+            name: format!("bootstrap-device-{device}"),
+            alias: None,
+            status: EntityStatus::Active,
+            attributes: None,
+            tenant_id: Some(tenant),
+            credentials: vec![],
+        }],
+        permission_blocks: vec![BootstrapPermissionBlock {
+            id: block,
+            scope: BootstrapScope {
+                mode: ScopeMode::ObjectType,
+                tenant_id: Some(tenant),
+                object_kind: Some("resource".to_string()),
+                object_type: Some("resource:channel".to_string()),
+                object_id: None,
+                group_id: None,
+            },
+            actions: vec!["publish".to_string(), "subscribe".to_string()],
+            effect: Default::default(),
+            conditions: None,
+        }],
+        roles: vec![BootstrapRole {
+            id: role,
+            name: format!("publisher-{role}"),
+            tenant_id: Some(tenant),
+            description: Some("can publish".to_string()),
+            permission_blocks: vec![block],
+        }],
+        role_assignments: vec![BootstrapRoleAssignment {
+            id: assignment,
+            tenant_id: Some(tenant),
+            subject: BootstrapSubject {
+                kind: SubjectKind::Entity,
+                id: device,
+            },
+            role_id: role,
+        }],
+        ..Default::default()
+    }
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_provisions_full_rbac_graph() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let tenant = Uuid::new_v4();
+    let device = Uuid::new_v4();
+    let block = Uuid::new_v4();
+    let role = Uuid::new_v4();
+    let assignment = Uuid::new_v4();
+    let cfg = rbac_config(tenant, device, block, role, assignment);
+
+    // Apply twice to prove the whole graph is idempotent.
+    apply(&p, &signing_keys, &cfg).await.expect("first apply");
+    apply(&p, &signing_keys, &cfg).await.expect("second apply");
+
+    // Rows exist and are linked.
+    let entity_tenant: Option<Uuid> =
+        sqlx::query_scalar("SELECT tenant_id FROM entities WHERE id = $1")
+            .bind(device)
+            .fetch_one(&p)
+            .await
+            .expect("device entity");
+    assert_eq!(entity_tenant, Some(tenant));
+
+    let link_count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM role_permission_blocks WHERE role_id = $1 AND permission_block_id = $2",
+    )
+    .bind(role)
+    .bind(block)
+    .fetch_one(&p)
+    .await
+    .expect("role/block link");
+    assert_eq!(link_count, 1, "block linked to role exactly once");
+
+    let action_count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM permission_block_actions WHERE permission_block_id = $1",
+    )
+    .bind(block)
+    .fetch_one(&p)
+    .await
+    .expect("block actions");
+    assert_eq!(
+        action_count, 2,
+        "publish + subscribe resolved to action rows"
+    );
+
+    // End-to-end: the assigned device now effectively holds `publish` via the
+    // canonical grant expansion the PDP consumes.
+    let publish_grants: i64 = sqlx::query_scalar(
+        r#"SELECT COUNT(*)
+           FROM subject_effective_grants($1) g
+           JOIN actions a ON a.id = g.capability_id
+           WHERE a.name = 'publish' AND g.effect = 'allow'"#,
+    )
+    .bind(device)
+    .fetch_one(&p)
+    .await
+    .expect("effective grants");
+    assert!(
+        publish_grants >= 1,
+        "device should effectively hold an allow-publish grant"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_supports_group_subjects_and_direct_policies() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let tenant = Uuid::new_v4();
+    let device = Uuid::new_v4();
+    let block = Uuid::new_v4();
+    let group = Uuid::new_v4();
+
+    let cfg = BootstrapConfig {
+        tenants: vec![BootstrapTenant {
+            id: tenant,
+            name: format!("bootstrap-tenant-{tenant}"),
+            alias: None,
+            tags: vec![],
+            attributes: None,
+            status: TenantStatus::Active,
+        }],
+        entities: vec![BootstrapEntity {
+            id: device,
+            kind: EntityKind::Device,
+            name: format!("bootstrap-device-{device}"),
+            alias: None,
+            status: EntityStatus::Active,
+            attributes: None,
+            tenant_id: Some(tenant),
+            credentials: vec![],
+        }],
+        groups: vec![BootstrapGroup {
+            id: group,
+            name: format!("publishers-{group}"),
+            tenant_id: Some(tenant),
+            description: None,
+            attributes: None,
+            members: vec![device],
+        }],
+        permission_blocks: vec![BootstrapPermissionBlock {
+            id: block,
+            scope: BootstrapScope {
+                mode: ScopeMode::Tenant,
+                tenant_id: Some(tenant),
+                object_kind: None,
+                object_type: None,
+                object_id: None,
+                group_id: None,
+            },
+            actions: vec!["read".to_string()],
+            effect: Default::default(),
+            conditions: None,
+        }],
+        direct_policies: vec![BootstrapDirectPolicy {
+            id: Uuid::new_v4(),
+            tenant_id: Some(tenant),
+            subject: BootstrapSubject {
+                kind: SubjectKind::Group,
+                id: group,
+            },
+            permission_block_id: block,
+        }],
+        ..Default::default()
+    };
+
+    apply(&p, &signing_keys, &cfg).await.expect("apply");
+
+    let member_count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM principal_group_members WHERE group_id = $1 AND entity_id = $2",
+    )
+    .bind(group)
+    .bind(device)
+    .fetch_one(&p)
+    .await
+    .expect("membership");
+    assert_eq!(member_count, 1);
+
+    // The device inherits the group's direct policy: it should effectively hold
+    // an allow-read grant through group membership.
+    let read_grants: i64 = sqlx::query_scalar(
+        r#"SELECT COUNT(*)
+           FROM subject_effective_grants($1) g
+           JOIN actions a ON a.id = g.capability_id
+           WHERE a.name = 'read' AND g.effect = 'allow'"#,
+    )
+    .bind(device)
+    .fetch_one(&p)
+    .await
+    .expect("effective grants");
+    assert!(
+        read_grants >= 1,
+        "device should inherit read via group direct policy"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_provisions_resources_and_object_group_scoped_grant() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let tenant = Uuid::new_v4();
+    let device = Uuid::new_v4();
+    let channel = Uuid::new_v4();
+    let object_group = Uuid::new_v4();
+    let block = Uuid::new_v4();
+    let role = Uuid::new_v4();
+
+    let cfg = BootstrapConfig {
+        tenants: vec![BootstrapTenant {
+            id: tenant,
+            name: format!("bootstrap-tenant-{tenant}"),
+            alias: None,
+            tags: vec![],
+            attributes: None,
+            status: TenantStatus::Active,
+        }],
+        entities: vec![BootstrapEntity {
+            id: device,
+            kind: EntityKind::Device,
+            name: format!("bootstrap-device-{device}"),
+            alias: None,
+            status: EntityStatus::Active,
+            attributes: None,
+            tenant_id: Some(tenant),
+            credentials: vec![],
+        }],
+        resources: vec![BootstrapResource {
+            id: channel,
+            kind: "channel".to_string(),
+            name: Some("temperature".to_string()),
+            alias: None,
+            tenant_id: Some(tenant),
+            owner_id: Some(device),
+            attributes: None,
+        }],
+        object_groups: vec![BootstrapObjectGroup {
+            id: object_group,
+            name: format!("channels-{object_group}"),
+            tenant_id: Some(tenant),
+            description: None,
+            attributes: None,
+            parent: None,
+            entities: vec![],
+            resources: vec![channel],
+        }],
+        permission_blocks: vec![BootstrapPermissionBlock {
+            id: block,
+            scope: BootstrapScope {
+                mode: ScopeMode::GroupDirectObjects,
+                tenant_id: Some(tenant),
+                object_kind: Some("resource".to_string()),
+                object_type: Some("resource:channel".to_string()),
+                object_id: None,
+                group_id: Some(object_group),
+            },
+            actions: vec!["publish".to_string()],
+            effect: Default::default(),
+            conditions: None,
+        }],
+        roles: vec![BootstrapRole {
+            id: role,
+            name: format!("channel-publisher-{role}"),
+            tenant_id: Some(tenant),
+            description: None,
+            permission_blocks: vec![block],
+        }],
+        role_assignments: vec![BootstrapRoleAssignment {
+            id: Uuid::new_v4(),
+            tenant_id: Some(tenant),
+            subject: BootstrapSubject {
+                kind: SubjectKind::Entity,
+                id: device,
+            },
+            role_id: role,
+        }],
+        // `publish` applicability on `resource:channel` is product-specific
+        // and no longer seeded by the migration; declare it here so the PDP
+        // can find the capability for the channel object type.
+        capabilities: vec![BootstrapCapability {
+            name: "publish".to_string(),
+            description: None,
+            applicability: vec![BootstrapCapabilityApplicability {
+                object_kind: ObjectKind::Resource,
+                object_type: Some("resource:channel".to_string()),
+            }],
+        }],
+        ..Default::default()
+    };
+
+    // Apply twice for idempotency, then let the PDP prove the whole chain.
+    apply(&p, &signing_keys, &cfg).await.expect("first apply");
+    apply(&p, &signing_keys, &cfg).await.expect("second apply");
+
+    // Resource + object-group membership landed.
+    let membership: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM object_group_resources WHERE group_id = $1 AND resource_id = $2",
+    )
+    .bind(object_group)
+    .bind(channel)
+    .fetch_one(&p)
+    .await
+    .expect("membership");
+    assert_eq!(membership, 1);
+
+    // End-to-end: the device can publish on the channel because the group-scoped
+    // block grants publish on resource members of the object group it belongs to.
+    let req = AuthzRequest {
+        subject_id: device,
+        action: "publish".to_string(),
+        resource_id: Some(channel),
+        object_kind: None,
+        object_id: None,
+        context: json!({}),
+    };
+    let resp = atom::authz::engine::evaluate_with_ceiling(&p, &req, None)
+        .await
+        .expect("evaluate");
+    assert!(
+        resp.allowed,
+        "device should be allowed to publish on the channel: {}",
+        resp.reason
+    );
+
+    // A different channel outside the object group must NOT be allowed.
+    let other_channel = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO resources (id, kind, name, tenant_id) VALUES ($1, 'channel', 'other', $2)",
+    )
+    .bind(other_channel)
+    .bind(tenant)
+    .execute(&p)
+    .await
+    .expect("insert other channel");
+    let deny_req = AuthzRequest {
+        subject_id: device,
+        action: "publish".to_string(),
+        resource_id: Some(other_channel),
+        object_kind: None,
+        object_id: None,
+        context: json!({}),
+    };
+    let deny = atom::authz::engine::evaluate_with_ceiling(&p, &deny_req, None)
+        .await
+        .expect("evaluate other");
+    assert!(
+        !deny.allowed,
+        "a channel outside the object group must not be granted"
+    );
+}
diff --git a/tests/m26_config_managed_capabilities.rs b/tests/m26_config_managed_capabilities.rs
new file mode 100644
index 00000000..6b9dec8e
--- /dev/null
+++ b/tests/m26_config_managed_capabilities.rs
@@ -0,0 +1,285 @@
+//! Bootstrap-managed capabilities, applicability and assignment rules.
+//!
+//! Covers the `managed_by='config'` marker written by the bootstrap loader and
+//! the API guard that refuses to mutate rows carrying it.
+//!
+//! Run with:
+//! ```bash
+//! DATABASE_URL=postgres://... cargo test --test m26_config_managed_capabilities -- --ignored
+//! ```
+
+mod common;
+
+use atom::authz::repo;
+use atom::bootstrap::{
+    apply, BootstrapActionAssignmentRule, BootstrapCapability, BootstrapCapabilityApplicability,
+    BootstrapConfig,
+};
+use atom::config::Config;
+use atom::models::capability::{CapabilityApplicabilityInput, CreateCapability, UpdateCapability};
+use atom::models::enums::{ActionAssignmentDecision, EntityKind, ObjectKind};
+use common::pool;
+use uuid::Uuid;
+
+fn capability_config(name: &str, object_type: &str) -> BootstrapConfig {
+    BootstrapConfig {
+        capabilities: vec![BootstrapCapability {
+            name: name.to_string(),
+            description: Some(format!("bootstrap {name}")),
+            applicability: vec![BootstrapCapabilityApplicability {
+                object_kind: ObjectKind::Resource,
+                object_type: Some(object_type.to_string()),
+            }],
+        }],
+        ..Default::default()
+    }
+}
+
+async fn action_id(pool: &sqlx::PgPool, name: &str) -> Uuid {
+    sqlx::query_scalar("SELECT id FROM actions WHERE name = $1")
+        .bind(name)
+        .fetch_one(pool)
+        .await
+        .expect("capability id lookup")
+}
+
+async fn managed_by(pool: &sqlx::PgPool, name: &str) -> Option<String> {
+    sqlx::query_scalar("SELECT managed_by FROM actions WHERE name = $1")
+        .bind(name)
+        .fetch_one(pool)
+        .await
+        .expect("capability managed_by lookup")
+}
+
+#[tokio::test]
+#[ignore]
+async fn capability_bootstrap_stamps_managed_by_config() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let name = format!("bootstrap-cap-{}", Uuid::new_v4());
+    let object_type = format!("resource:bootstrap-{}", Uuid::new_v4());
+    let cfg = capability_config(&name, &object_type);
+
+    apply(&p, &signing_keys, &cfg)
+        .await
+        .expect("apply bootstrap");
+
+    assert_eq!(managed_by(&p, &name).await.as_deref(), Some("config"));
+
+    let app_managed: Option<String> = sqlx::query_scalar(
+        r#"SELECT ca.managed_by
+             FROM action_applicability ca
+             JOIN actions a ON a.id = ca.action_id
+            WHERE a.name = $1 AND ca.object_type = $2"#,
+    )
+    .bind(&name)
+    .bind(&object_type)
+    .fetch_one(&p)
+    .await
+    .expect("applicability lookup");
+    assert_eq!(app_managed.as_deref(), Some("config"));
+}
+
+#[tokio::test]
+#[ignore]
+async fn capability_bootstrap_is_idempotent() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let name = format!("bootstrap-cap-{}", Uuid::new_v4());
+    let object_type = format!("resource:bootstrap-{}", Uuid::new_v4());
+    let cfg = capability_config(&name, &object_type);
+
+    apply(&p, &signing_keys, &cfg).await.expect("first apply");
+    apply(&p, &signing_keys, &cfg).await.expect("second apply");
+
+    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM actions WHERE name = $1")
+        .bind(&name)
+        .fetch_one(&p)
+        .await
+        .expect("count capabilities");
+    assert_eq!(count, 1);
+
+    let app_count: i64 = sqlx::query_scalar(
+        r#"SELECT COUNT(*)
+             FROM action_applicability ca
+             JOIN actions a ON a.id = ca.action_id
+            WHERE a.name = $1"#,
+    )
+    .bind(&name)
+    .fetch_one(&p)
+    .await
+    .expect("count applicability");
+    assert_eq!(app_count, 1);
+}
+
+#[tokio::test]
+#[ignore]
+async fn api_cannot_update_config_managed_capability() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let name = format!("bootstrap-cap-{}", Uuid::new_v4());
+    let object_type = format!("resource:bootstrap-{}", Uuid::new_v4());
+    apply(&p, &signing_keys, &capability_config(&name, &object_type))
+        .await
+        .expect("apply bootstrap");
+
+    let id = action_id(&p, &name).await;
+    let err = repo::update_capability(
+        &p,
+        id,
+        UpdateCapability {
+            name: None,
+            description: Some("hijacked".to_string()),
+            applicability: None,
+        },
+    )
+    .await
+    .expect_err("update must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected error: {err:?}"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn api_cannot_delete_config_managed_capability() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let name = format!("bootstrap-cap-{}", Uuid::new_v4());
+    let object_type = format!("resource:bootstrap-{}", Uuid::new_v4());
+    apply(&p, &signing_keys, &capability_config(&name, &object_type))
+        .await
+        .expect("apply bootstrap");
+
+    let id = action_id(&p, &name).await;
+    let err = repo::delete_capability(&p, id)
+        .await
+        .expect_err("delete must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected error: {err:?}"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn api_can_add_but_not_remove_config_managed_applicability() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let name = format!("bootstrap-cap-{}", Uuid::new_v4());
+    let seeded_type = format!("resource:bootstrap-{}", Uuid::new_v4());
+    apply(&p, &signing_keys, &capability_config(&name, &seeded_type))
+        .await
+        .expect("apply bootstrap");
+
+    let id = action_id(&p, &name).await;
+
+    // Adding a new applicability entry alongside a config-managed one is
+    // allowed — API extensions are additive.
+    let extra_type = format!("resource:api-{}", Uuid::new_v4());
+    repo::add_capability_applicability(&p, id, "resource".to_string(), Some(extra_type.clone()))
+        .await
+        .expect("add applicability");
+
+    // Removing the config-managed row must be rejected.
+    let err = repo::remove_capability_applicability(
+        &p,
+        id,
+        "resource".to_string(),
+        Some(seeded_type.clone()),
+    )
+    .await
+    .expect_err("removing config-managed applicability must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected error: {err:?}"
+    );
+
+    // Removing the API-added row is still allowed.
+    repo::remove_capability_applicability(&p, id, "resource".to_string(), Some(extra_type))
+        .await
+        .expect("removing api-managed applicability is allowed");
+}
+
+#[tokio::test]
+#[ignore]
+async fn assignment_rule_bootstrap_stamps_managed_by_and_guards_delete() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let name = format!("bootstrap-cap-{}", Uuid::new_v4());
+    let object_type = format!("resource:bootstrap-{}", Uuid::new_v4());
+
+    // Bootstrap must declare the capability before the rule that references it.
+    let cfg = BootstrapConfig {
+        capabilities: vec![BootstrapCapability {
+            name: name.clone(),
+            description: None,
+            applicability: vec![BootstrapCapabilityApplicability {
+                object_kind: ObjectKind::Resource,
+                object_type: Some(object_type.clone()),
+            }],
+        }],
+        action_assignment_rules: vec![BootstrapActionAssignmentRule {
+            tenant_id: None,
+            entity_kind: EntityKind::Device,
+            action_name: name.clone(),
+            object_kind: ObjectKind::Resource,
+            object_type: Some(object_type.clone()),
+            decision: ActionAssignmentDecision::Allow,
+            is_absolute: false,
+        }],
+        ..Default::default()
+    };
+
+    apply(&p, &signing_keys, &cfg)
+        .await
+        .expect("apply bootstrap");
+
+    let (rule_id, rule_managed_by): (Uuid, Option<String>) = sqlx::query_as(
+        r#"SELECT id, managed_by
+             FROM action_assignment_rules
+            WHERE entity_kind = 'device'
+              AND action_name = $1"#,
+    )
+    .bind(&name)
+    .fetch_one(&p)
+    .await
+    .expect("rule lookup");
+    assert_eq!(rule_managed_by.as_deref(), Some("config"));
+
+    let err = repo::delete_action_assignment_rule(&p, rule_id)
+        .await
+        .expect_err("delete must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected error: {err:?}"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn api_created_capability_stays_api_managed() {
+    // Sanity check: rows created via the API must not accidentally be stamped
+    // as config-managed, so their normal edit/delete paths still work.
+    let p = pool().await;
+    let name = format!("api-cap-{}", Uuid::new_v4());
+    let cap = repo::create_capability(
+        &p,
+        CreateCapability {
+            name: name.clone(),
+            description: Some("api-created".to_string()),
+            applicability: Some(vec![CapabilityApplicabilityInput {
+                object_kind: "resource".to_string(),
+                object_type: Some(format!("resource:api-{}", Uuid::new_v4())),
+            }]),
+        },
+    )
+    .await
+    .expect("create capability");
+
+    assert!(managed_by(&p, &name).await.is_none());
+    repo::delete_capability(&p, cap.id)
+        .await
+        .expect("delete api-managed capability");
+}
diff --git a/tests/m27_config_managed_identity.rs b/tests/m27_config_managed_identity.rs
new file mode 100644
index 00000000..380382ab
--- /dev/null
+++ b/tests/m27_config_managed_identity.rs
@@ -0,0 +1,277 @@
+//! Bootstrap-managed entities, credentials and access tokens.
+//!
+//! Covers migration 006: entities and credentials created from the bootstrap
+//! YAML are stamped `managed_by='config'`, blocking API mutation and hiding
+//! credentials from list/read responses.
+//!
+//! Run with:
+//! ```bash
+//! DATABASE_URL=postgres://... cargo test --test m27_config_managed_identity -- --ignored
+//! ```
+
+mod common;
+
+use atom::auth::make_api_key;
+use atom::bootstrap::{apply, BootstrapConfig, BootstrapCredential, BootstrapEntity};
+use atom::config::Config;
+use atom::identity::{access_tokens, repo, service};
+use atom::models::entity::UpdateEntity;
+use atom::models::enums::{EntityKind, EntityStatus};
+use common::pool;
+use uuid::Uuid;
+
+fn service_entity(id: Uuid, credentials: Vec<BootstrapCredential>) -> BootstrapConfig {
+    BootstrapConfig {
+        entities: vec![BootstrapEntity {
+            id,
+            kind: EntityKind::Service,
+            name: format!("cfg-service-{id}"),
+            alias: None,
+            status: EntityStatus::Active,
+            attributes: None,
+            tenant_id: None,
+            credentials,
+        }],
+        ..Default::default()
+    }
+}
+
+async fn managed_by_entity(pool: &sqlx::PgPool, id: Uuid) -> Option<String> {
+    sqlx::query_scalar("SELECT managed_by FROM entities WHERE id = $1")
+        .bind(id)
+        .fetch_one(pool)
+        .await
+        .expect("entity managed_by lookup")
+}
+
+async fn managed_by_credential(pool: &sqlx::PgPool, id: Uuid) -> Option<String> {
+    sqlx::query_scalar("SELECT managed_by FROM credentials WHERE id = $1")
+        .bind(id)
+        .fetch_one(pool)
+        .await
+        .expect("credential managed_by lookup")
+}
+
+fn bootstrap_token() -> (Uuid, String) {
+    let cred_id = Uuid::new_v4();
+    let mut secret = [0u8; 32];
+    for (i, b) in secret.iter_mut().enumerate() {
+        *b = (i as u8).wrapping_mul(37).wrapping_add(1);
+    }
+    (cred_id, make_api_key(cred_id, &secret))
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_entity_is_stamped_and_rejects_api_mutations() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let entity_id = Uuid::new_v4();
+    let cfg = service_entity(entity_id, vec![]);
+
+    apply(&p, &signing_keys, &cfg)
+        .await
+        .expect("apply bootstrap");
+
+    assert_eq!(
+        managed_by_entity(&p, entity_id).await.as_deref(),
+        Some("config")
+    );
+
+    let err = repo::update_entity(
+        &p,
+        entity_id,
+        UpdateEntity {
+            name: Some("hijacked".to_string()),
+            kind: None,
+            alias: None,
+            tenant_id: None,
+            profile_id: None,
+            profile_version_id: None,
+            status: None,
+            attributes: None,
+        },
+    )
+    .await
+    .expect_err("update must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected: {err:?}"
+    );
+
+    let err = repo::delete_entity(&p, entity_id, None)
+        .await
+        .expect_err("delete must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected: {err:?}"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_access_token_is_visible_read_only() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let entity_id = Uuid::new_v4();
+    let (cred_id, token) = bootstrap_token();
+    let cfg = service_entity(
+        entity_id,
+        vec![BootstrapCredential::AccessToken {
+            token: token.clone(),
+            name: "journal".to_string(),
+            description: Some("bootstrap".to_string()),
+        }],
+    );
+
+    apply(&p, &signing_keys, &cfg)
+        .await
+        .expect("apply bootstrap");
+
+    // The credential row exists and is stamped.
+    assert_eq!(
+        managed_by_credential(&p, cred_id).await.as_deref(),
+        Some("config")
+    );
+
+    // list_credentials surfaces it (with managed_by='config') so the UI can
+    // render it read-only. This is a deliberate reversal of the earlier
+    // "hidden" posture — no secret material leaks through the metadata.
+    let creds = service::list_credentials(&p, entity_id)
+        .await
+        .expect("list");
+    let cred = creds
+        .iter()
+        .find(|c| c.id == cred_id)
+        .expect("bootstrap credential must appear in list");
+    assert_eq!(cred.managed_by.as_deref(), Some("config"));
+
+    // list_access_tokens surfaces the token with the same marker.
+    let (tokens, total) = access_tokens::list_access_tokens(
+        &p,
+        entity_id,
+        access_tokens::ListAccessTokens {
+            status: None,
+            limit: 100,
+            offset: 0,
+        },
+    )
+    .await
+    .expect("list access tokens");
+    assert_eq!(total, 1);
+    assert_eq!(tokens.len(), 1);
+    assert_eq!(tokens[0].credential_id, cred_id);
+    assert_eq!(tokens[0].managed_by.as_deref(), Some("config"));
+
+    // Revoke must be rejected with 409 conflict — the UI reads the marker
+    // and disables the button, but a direct API call still gets a clear
+    // "managed by bootstrap config" reason.
+    let err = access_tokens::revoke_access_token(&p, entity_id, cred_id)
+        .await
+        .expect_err("revoke must be rejected");
+    assert!(
+        format!("{err:?}").contains("bootstrap config"),
+        "unexpected: {err:?}"
+    );
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_access_token_is_idempotent() {
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let entity_id = Uuid::new_v4();
+    let (cred_id, token) = bootstrap_token();
+    let cfg = service_entity(
+        entity_id,
+        vec![BootstrapCredential::AccessToken {
+            token,
+            name: "journal".to_string(),
+            description: None,
+        }],
+    );
+
+    apply(&p, &signing_keys, &cfg).await.expect("first apply");
+    apply(&p, &signing_keys, &cfg).await.expect("second apply");
+
+    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM credentials WHERE id = $1")
+        .bind(cred_id)
+        .fetch_one(&p)
+        .await
+        .expect("count credential");
+    assert_eq!(count, 1);
+}
+
+#[tokio::test]
+#[ignore]
+async fn bootstrap_access_token_authenticates_at_runtime() {
+    // The whole point of bootstrap tokens is that services authenticate with
+    // them at runtime — so the managed_by hide must NOT reach the auth path.
+    // Verify the auth lookup ignores managed_by by asking the same query the
+    // auth path runs and confirming the row is visible for authentication.
+    let p = pool().await;
+    let signing_keys = Config::for_tests().signing_keys;
+    let entity_id = Uuid::new_v4();
+    let (cred_id, _token) = bootstrap_token();
+    let cfg = service_entity(
+        entity_id,
+        vec![BootstrapCredential::AccessToken {
+            token: _token,
+            name: "journal".to_string(),
+            description: None,
+        }],
+    );
+
+    apply(&p, &signing_keys, &cfg)
+        .await
+        .expect("apply bootstrap");
+
+    let entity_ok: Option<Uuid> = sqlx::query_scalar(
+        r#"SELECT c.entity_id
+           FROM credentials c
+           JOIN entities e ON e.id = c.entity_id
+           WHERE c.id = $1 AND c.kind = 'access_token' AND c.status = 'active'
+             AND e.deleted_at IS NULL"#,
+    )
+    .bind(cred_id)
+    .fetch_optional(&p)
+    .await
+    .expect("auth-path lookup");
+    assert_eq!(entity_ok, Some(entity_id));
+}
+
+#[tokio::test]
+#[ignore]
+async fn api_created_entity_and_credential_are_not_stamped() {
+    // Sanity check: only bootstrap-planted rows carry the flag; normal API
+    // creations remain fully mutable and visible.
+    let p = pool().await;
+
+    let entity_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO entities (id, kind, name, status) VALUES ($1, 'service', $2, 'active')",
+    )
+    .bind(entity_id)
+    .bind(format!("runtime-{entity_id}"))
+    .execute(&p)
+    .await
+    .expect("insert entity");
+    assert!(managed_by_entity(&p, entity_id).await.is_none());
+
+    let cred_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO credentials (id, entity_id, kind, secret_hash) VALUES ($1, $2, 'password', 'x')",
+    )
+    .bind(cred_id)
+    .bind(entity_id)
+    .execute(&p)
+    .await
+    .expect("insert credential");
+    assert!(managed_by_credential(&p, cred_id).await.is_none());
+
+    // The API mutation guard lets these through.
+    let creds = service::list_credentials(&p, entity_id)
+        .await
+        .expect("list");
+    assert!(creds.iter().any(|c| c.id == cred_id));
+}
diff --git a/tests/m29_callouts.rs b/tests/m29_callouts.rs
new file mode 100644
index 00000000..d84025b6
--- /dev/null
+++ b/tests/m29_callouts.rs
@@ -0,0 +1,502 @@
+//! Callout integration tests.
+//!
+//! These tests spin up in-process mock HTTP and gRPC policy services and
+//! drive the [`atom::callout::CalloutService`] runner end-to-end. They do
+//! not require the DB, so they run under plain `cargo test`.
+
+use std::{
+    net::SocketAddr,
+    sync::{Arc, Mutex},
+    time::Duration,
+};
+
+use atom::callout::{
+    config::{
+        CalloutsFile, EndpointConfig, EndpointId, GrpcTransportConfig, HttpMethod,
+        HttpTransportConfig, OnError, OperationConfig, SurfaceKind, TransportConfig,
+    },
+    envelope::Actor,
+    CalloutOutcome, CalloutService, CalloutsConfig, Surface,
+};
+use axum::{extract::State, routing::post, Json, Router};
+use tokio::{net::TcpListener, sync::oneshot};
+
+// ─── HTTP mock ────────────────────────────────────────────────────────────
+
+#[derive(Clone)]
+struct HttpMockState {
+    recorded: Arc<Mutex<Vec<serde_json::Value>>>,
+    behaviour: Behaviour,
+}
+
+#[derive(Clone)]
+enum Behaviour {
+    Allow,
+    Deny(String),
+    /// Sleep for the given duration before responding — used to force a
+    /// timeout on the client side.
+    Delay(Duration),
+    /// Return HTTP 500 with a body.
+    Error(String),
+}
+
+async fn http_handler(
+    State(state): State<HttpMockState>,
+    Json(body): Json<serde_json::Value>,
+) -> Result<axum::response::Response, (axum::http::StatusCode, String)> {
+    state.recorded.lock().unwrap().push(body);
+    match &state.behaviour {
+        Behaviour::Allow => Ok(Json(serde_json::json!({"decision": "allow"})).into_response()),
+        Behaviour::Deny(reason) => Ok(Json(serde_json::json!({
+            "decision": "deny",
+            "reason": reason,
+        }))
+        .into_response()),
+        Behaviour::Delay(d) => {
+            tokio::time::sleep(*d).await;
+            Ok(Json(serde_json::json!({"decision": "allow"})).into_response())
+        }
+        Behaviour::Error(msg) => Err((axum::http::StatusCode::INTERNAL_SERVER_ERROR, msg.clone())),
+    }
+}
+
+fn axum_response_into<T: axum::response::IntoResponse>() {}
+
+use axum::response::IntoResponse;
+
+async fn spawn_http_mock(behaviour: Behaviour) -> (String, HttpMockState, oneshot::Sender<()>) {
+    let state = HttpMockState {
+        recorded: Arc::new(Mutex::new(Vec::new())),
+        behaviour,
+    };
+    let app = Router::new()
+        .route("/authz", post(http_handler))
+        .with_state(state.clone());
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let (tx, rx) = oneshot::channel();
+    tokio::spawn(async move {
+        axum::serve(listener, app)
+            .with_graceful_shutdown(async {
+                let _ = rx.await;
+            })
+            .await
+            .unwrap();
+    });
+    let _: fn() = axum_response_into::<axum::response::Response>;
+    (format!("http://{addr}/authz"), state, tx)
+}
+
+// ─── gRPC mock ────────────────────────────────────────────────────────────
+
+mod callout_proto {
+    tonic::include_proto!("atom.v1.callout");
+}
+
+use callout_proto::{
+    callout_response::Decision as ProtoDecision, callout_server::CalloutServer, CalloutResponse,
+};
+
+struct GrpcMock {
+    recorded: Arc<Mutex<Vec<callout_proto::CalloutRequest>>>,
+    behaviour: Behaviour,
+}
+
+#[tonic::async_trait]
+impl callout_proto::callout_server::Callout for GrpcMock {
+    async fn check(
+        &self,
+        request: tonic::Request<callout_proto::CalloutRequest>,
+    ) -> Result<tonic::Response<CalloutResponse>, tonic::Status> {
+        self.recorded.lock().unwrap().push(request.into_inner());
+        match &self.behaviour {
+            Behaviour::Allow => Ok(tonic::Response::new(CalloutResponse {
+                decision: ProtoDecision::Allow as i32,
+                reason: String::new(),
+            })),
+            Behaviour::Deny(reason) => Ok(tonic::Response::new(CalloutResponse {
+                decision: ProtoDecision::Deny as i32,
+                reason: reason.clone(),
+            })),
+            Behaviour::Delay(d) => {
+                tokio::time::sleep(*d).await;
+                Ok(tonic::Response::new(CalloutResponse {
+                    decision: ProtoDecision::Allow as i32,
+                    reason: String::new(),
+                }))
+            }
+            Behaviour::Error(msg) => Err(tonic::Status::internal(msg.clone())),
+        }
+    }
+}
+
+async fn spawn_grpc_mock(
+    behaviour: Behaviour,
+) -> (
+    String,
+    Arc<Mutex<Vec<callout_proto::CalloutRequest>>>,
+    oneshot::Sender<()>,
+) {
+    let recorded = Arc::new(Mutex::new(Vec::new()));
+    let svc = GrpcMock {
+        recorded: recorded.clone(),
+        behaviour,
+    };
+    let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
+    let listener = TcpListener::bind(addr).await.unwrap();
+    let bound = listener.local_addr().unwrap();
+    let incoming = tonic::transport::server::TcpIncoming::from_listener(
+        listener,
+        true,
+        Some(Duration::from_secs(1)),
+    )
+    .unwrap();
+    let (tx, rx) = oneshot::channel();
+    tokio::spawn(async move {
+        tonic::transport::Server::builder()
+            .add_service(CalloutServer::new(svc))
+            .serve_with_incoming_shutdown(incoming, async {
+                let _ = rx.await;
+            })
+            .await
+            .unwrap();
+    });
+    (format!("http://{bound}"), recorded, tx)
+}
+
+// ─── config helpers ───────────────────────────────────────────────────────
+
+fn http_endpoint(id: &str, url: &str, on_error: OnError, timeout_ms: u64) -> EndpointConfig {
+    EndpointConfig {
+        id: EndpointId(id.to_string()),
+        transport: TransportConfig::Http(HttpTransportConfig {
+            url: url.to_string(),
+            method: HttpMethod::Post,
+            headers: Default::default(),
+        }),
+        timeout_ms,
+        tls: None,
+        on_error,
+    }
+}
+
+fn grpc_endpoint(id: &str, address: &str, on_error: OnError, timeout_ms: u64) -> EndpointConfig {
+    EndpointConfig {
+        id: EndpointId(id.to_string()),
+        transport: TransportConfig::Grpc(GrpcTransportConfig {
+            address: address.to_string(),
+        }),
+        timeout_ms,
+        tls: None,
+        on_error,
+    }
+}
+
+fn op(name: &str, endpoints: &[&str], include: &[&str]) -> OperationConfig {
+    OperationConfig {
+        name: name.to_string(),
+        surface: SurfaceKind::Graphql,
+        endpoints: endpoints
+            .iter()
+            .map(|e| EndpointId(e.to_string()))
+            .collect(),
+        include: include.iter().map(|s| s.to_string()).collect(),
+        extra: Default::default(),
+    }
+}
+
+fn build_service(endpoints: Vec<EndpointConfig>, ops: Vec<OperationConfig>) -> CalloutsFile {
+    CalloutsFile {
+        callouts: atom::callout::config::CalloutsSection {
+            endpoints,
+            operations: ops,
+        },
+    }
+}
+
+fn dummy_actor() -> Actor {
+    Actor {
+        entity_id: "00000000-0000-0000-0000-000000000001".into(),
+        tenant_id: "22222222-2222-2222-2222-222222222222".into(),
+        scope: "session".into(),
+        ..Default::default()
+    }
+}
+
+// ─── tests ────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn http_allow_lets_call_through_and_forwards_payload() {
+    let (url, mock, shutdown) = spawn_http_mock(Behaviour::Allow).await;
+    let cfg = CalloutsConfig::build(build_service(
+        vec![http_endpoint("policy", &url, OnError::Deny, 2000)],
+        vec![op(
+            "createEntity",
+            &["policy"],
+            &["actor.entity_id", "args.input.name"],
+        )],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({"input": {"name": "gadget", "kind": "device"}}),
+        )
+        .await;
+    assert!(matches!(outcome, CalloutOutcome::Allow));
+
+    let recorded = mock.recorded.lock().unwrap();
+    assert_eq!(recorded.len(), 1);
+    assert_eq!(recorded[0]["operation"], "createEntity");
+    assert_eq!(
+        recorded[0]["actor"]["entity_id"],
+        "00000000-0000-0000-0000-000000000001"
+    );
+    // Only whitelisted args made it through.
+    assert_eq!(recorded[0]["args"]["input"]["name"], "gadget");
+    assert!(recorded[0]["args"]["input"].get("kind").is_none());
+
+    let _ = shutdown.send(());
+}
+
+#[tokio::test]
+async fn http_deny_short_circuits_with_reason_and_endpoint() {
+    let (url, _mock, shutdown) =
+        spawn_http_mock(Behaviour::Deny("policy blocks new entities".into())).await;
+    let cfg = CalloutsConfig::build(build_service(
+        vec![http_endpoint("policy", &url, OnError::Deny, 2000)],
+        vec![op("createEntity", &["policy"], &[])],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    match outcome {
+        CalloutOutcome::Deny {
+            reason,
+            endpoint_id,
+        } => {
+            assert_eq!(endpoint_id, "policy");
+            assert!(reason.contains("policy blocks new entities"));
+        }
+        other => panic!("expected deny, got {other:?}"),
+    }
+    let _ = shutdown.send(());
+}
+
+#[tokio::test]
+async fn http_timeout_denies_when_on_error_deny() {
+    let (url, _mock, shutdown) =
+        spawn_http_mock(Behaviour::Delay(Duration::from_millis(500))).await;
+    let cfg = CalloutsConfig::build(build_service(
+        vec![http_endpoint("policy", &url, OnError::Deny, 50)],
+        vec![op("createEntity", &["policy"], &[])],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    assert!(
+        matches!(outcome, CalloutOutcome::Deny { .. }),
+        "expected deny, got {outcome:?}"
+    );
+    let _ = shutdown.send(());
+}
+
+#[tokio::test]
+async fn http_transport_error_allows_when_on_error_allow() {
+    let (url, _mock, shutdown) = spawn_http_mock(Behaviour::Error("upstream broken".into())).await;
+    let cfg = CalloutsConfig::build(build_service(
+        vec![http_endpoint("policy", &url, OnError::Allow, 2000)],
+        vec![op("createEntity", &["policy"], &[])],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    assert!(
+        matches!(outcome, CalloutOutcome::Allow),
+        "expected allow-on-error, got {outcome:?}"
+    );
+    let _ = shutdown.send(());
+}
+
+#[tokio::test]
+async fn multi_endpoint_chain_all_must_allow_and_fails_fast() {
+    let (allow_url, allow_mock, allow_shutdown) = spawn_http_mock(Behaviour::Allow).await;
+    let (deny_url, _deny_mock, deny_shutdown) =
+        spawn_http_mock(Behaviour::Deny("second stage denied".into())).await;
+    let (never_url, never_mock, never_shutdown) = spawn_http_mock(Behaviour::Allow).await;
+
+    let cfg = CalloutsConfig::build(build_service(
+        vec![
+            http_endpoint("stage1", &allow_url, OnError::Deny, 2000),
+            http_endpoint("stage2", &deny_url, OnError::Deny, 2000),
+            http_endpoint("stage3", &never_url, OnError::Deny, 2000),
+        ],
+        vec![op("createEntity", &["stage1", "stage2", "stage3"], &[])],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    match outcome {
+        CalloutOutcome::Deny { endpoint_id, .. } => assert_eq!(endpoint_id, "stage2"),
+        other => panic!("expected deny at stage2, got {other:?}"),
+    }
+    // stage1 was called, stage3 was not.
+    assert_eq!(allow_mock.recorded.lock().unwrap().len(), 1);
+    assert_eq!(never_mock.recorded.lock().unwrap().len(), 0);
+
+    let _ = allow_shutdown.send(());
+    let _ = deny_shutdown.send(());
+    let _ = never_shutdown.send(());
+}
+
+#[tokio::test]
+async fn grpc_allow_and_deny_end_to_end() {
+    let (address, recorded, shutdown) = spawn_grpc_mock(Behaviour::Allow).await;
+    // Give the server a beat to be ready.
+    tokio::time::sleep(Duration::from_millis(100)).await;
+
+    let cfg = CalloutsConfig::build(build_service(
+        vec![grpc_endpoint("policy", &address, OnError::Deny, 3000)],
+        vec![op(
+            "authzCheck",
+            &["policy"],
+            &["actor.entity_id", "args.action"],
+        )],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "authzCheck",
+            dummy_actor(),
+            serde_json::json!({"action": "publish"}),
+        )
+        .await;
+    assert!(matches!(outcome, CalloutOutcome::Allow), "{outcome:?}");
+    let entries = recorded.lock().unwrap();
+    assert_eq!(entries.len(), 1);
+    assert_eq!(entries[0].operation, "authzCheck");
+    assert_eq!(
+        entries[0].actor.as_ref().unwrap().entity_id,
+        "00000000-0000-0000-0000-000000000001"
+    );
+    drop(entries);
+    let _ = shutdown.send(());
+}
+
+#[tokio::test]
+async fn grpc_deny_short_circuits() {
+    let (address, _recorded, shutdown) =
+        spawn_grpc_mock(Behaviour::Deny("grpc says no".into())).await;
+    tokio::time::sleep(Duration::from_millis(100)).await;
+
+    let cfg = CalloutsConfig::build(build_service(
+        vec![grpc_endpoint("policy", &address, OnError::Deny, 3000)],
+        vec![op("createEntity", &["policy"], &[])],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    match outcome {
+        CalloutOutcome::Deny { reason, .. } => assert!(reason.contains("grpc says no")),
+        other => panic!("expected deny, got {other:?}"),
+    }
+    let _ = shutdown.send(());
+}
+
+#[tokio::test]
+async fn unconfigured_operation_short_circuits_to_not_configured() {
+    let cfg = CalloutsConfig::build(build_service(vec![], vec![])).unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "somethingElse",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    assert!(matches!(outcome, CalloutOutcome::NotConfigured));
+}
+
+#[tokio::test]
+async fn mixed_http_and_grpc_chain_stops_at_first_deny() {
+    let (grpc_addr, _grpc_recorded, grpc_shutdown) =
+        spawn_grpc_mock(Behaviour::Deny("grpc block".into())).await;
+    tokio::time::sleep(Duration::from_millis(100)).await;
+    let (http_url, http_state, http_shutdown) = spawn_http_mock(Behaviour::Allow).await;
+
+    let cfg = CalloutsConfig::build(build_service(
+        vec![
+            http_endpoint("http-stage", &http_url, OnError::Deny, 2000),
+            grpc_endpoint("grpc-stage", &grpc_addr, OnError::Deny, 3000),
+        ],
+        vec![op("createEntity", &["http-stage", "grpc-stage"], &[])],
+    ))
+    .unwrap();
+    let svc = CalloutService::build(cfg).await.unwrap();
+
+    let outcome = svc
+        .check(
+            Surface::GraphQL,
+            "createEntity",
+            dummy_actor(),
+            serde_json::json!({}),
+        )
+        .await;
+    match outcome {
+        CalloutOutcome::Deny { endpoint_id, .. } => assert_eq!(endpoint_id, "grpc-stage"),
+        other => panic!("expected deny at grpc-stage, got {other:?}"),
+    }
+    // http stage recorded one call before grpc denied.
+    assert_eq!(http_state.recorded.lock().unwrap().len(), 1);
+    let _ = grpc_shutdown.send(());
+    let _ = http_shutdown.send(());
+}
diff --git a/tests/m3_lifecycle.rs b/tests/m3_lifecycle.rs
index d8ca38f5..93cbe6d9 100644
--- a/tests/m3_lifecycle.rs
+++ b/tests/m3_lifecycle.rs
@@ -189,6 +189,22 @@ async fn platform_resource_unaffected_by_tenant_lifecycle() {
     // A resource with tenant_id = NULL (platform-scoped) must NOT be denied
     // by the lifecycle check.
     let p = pool().await;
+    // `publish` applicability on `resource:channel` is product-specific and
+    // migration 007 removes the seeded row; declare it inline so the
+    // capability lookup succeeds and the request reaches the lifecycle path.
+    // Sibling lifecycle-deny tests pass without this because tenant-frozen
+    // deny short-circuits before applicability is checked; this platform test
+    // has no tenant to short-circuit on.
+    sqlx::query(
+        r#"INSERT INTO action_applicability (action_id, object_kind, object_type)
+           SELECT id, 'resource', 'resource:channel'
+             FROM actions WHERE name = 'publish'
+           ON CONFLICT DO NOTHING"#,
+    )
+    .execute(&p)
+    .await
+    .expect("seed publish applicability");
+
     let id = Uuid::new_v4();
     sqlx::query("INSERT INTO resources (id, kind, name) VALUES ($1, 'channel', $2)")
         .bind(id)
diff --git a/tests/m8_guardrails.rs b/tests/m8_guardrails.rs
index 8f6de075..cf945d43 100644
--- a/tests/m8_guardrails.rs
+++ b/tests/m8_guardrails.rs
@@ -204,6 +204,27 @@ async fn channel_scoped_role_rejects_rule_only_capability() {
     let publish_id = capability_id(&p, "publish").await;
     let execute_id = capability_id(&p, "execute").await;
 
+    // Applicability for `publish` on `resource:channel` and `execute` on
+    // `resource:rule` is product-specific and provisioned via the deployment's
+    // bootstrap config, not seeded by the migration. Add the applicability
+    // inline so this test is self-contained.
+    atom::authz::repo::add_capability_applicability(
+        &p,
+        publish_id,
+        "resource".to_string(),
+        Some("resource:channel".to_string()),
+    )
+    .await
+    .expect("seed publish applicability");
+    atom::authz::repo::add_capability_applicability(
+        &p,
+        execute_id,
+        "resource".to_string(),
+        Some("resource:rule".to_string()),
+    )
+    .await
+    .expect("seed execute applicability");
+
     atom::authz::repo::create_role_with_permission_blocks(
         &p,
         CreateRole {
@@ -259,6 +280,25 @@ async fn exact_object_permission_block_uses_real_object_type() {
     let publish_id = capability_id(&p, "publish").await;
     let execute_id = capability_id(&p, "execute").await;
 
+    // See sibling test — product-specific applicability is added inline
+    // instead of relying on migration-time seeding.
+    atom::authz::repo::add_capability_applicability(
+        &p,
+        publish_id,
+        "resource".to_string(),
+        Some("resource:channel".to_string()),
+    )
+    .await
+    .expect("seed publish applicability");
+    atom::authz::repo::add_capability_applicability(
+        &p,
+        execute_id,
+        "resource".to_string(),
+        Some("resource:rule".to_string()),
+    )
+    .await
+    .expect("seed execute applicability");
+
     atom::authz::repo::create_role_with_permission_blocks(
         &p,
         CreateRole {