Who is responsible for what

Must not depend on a particular application or concrete substrate. Data ownership does not follow a source repository or a running host.

The actual human or machine Thing is the principal. Its controllers and delegates act under applicable authority; the aThing code repository is not the owner of all Things.

Hosting a Thing's bytes or running its code confers no ownership of that Thing and no authority to decide for it. Concrete substrate/external-resource adapters belong here; not every provider of any interface does.

Resource owners and Cell operators retain their own admission policies. A Thing's permission does not oblige a provider to supply resources.

Must not create independent identity, permission or persistence authorities that bypass the Thing's supported interfaces. It may consume verified context and provide reusable behavior.

Agents, Intelligence and PolyAgent supply reasoning/action mechanisms. An agent's identity, Corpus and Agency remain those of its Thing; its implementation does not inherit unrestricted owner authority.