Three distinct populations change behaviour — the person who writes the words, the person accountable for them, and the person measuring them — and they need different permissions on the same key. That is why authoring, approval and promotion are separate grants (ADR-11).
The on-call engineer does not own the prompt. Every rollback affordance is designed for someone who has never read the configuration they are reverting.
The compliance reviewer's goal — "without taking anybody's word for it" — is why bundles are signed rather than merely stored.
Assumptions
≈ 40 prompt engineers across product teams, issuing ≈ 200 promotions/day at peak (stated assumption).
A 24×7 on-call rota already exists and the registry hooks into it rather than creating one.
Support leads have access to a conversation record that carries the digest. If they do not, the trace-an-answer journey has no starting point.
What this view rules out
A design where only the owning team can roll back. Two of the nine actors need to act on a key they do not own, at a time when nobody who owns it is awake.
Approval flows that assume the approver can read a diff of the service. Product owners approve wording, not code.
