Add KV prefix capability matching

README.md

@@ -118,7 +118,10 @@ Everything meaningful is modeled as a resource. Planned resource kinds are:
 - `ssh-proxy`: authorized SSH proxy/admin access over Iroh
 
 Authorization is resource-scoped and capability-based. Bearer secrets may grant
-specific resource capabilities but do not create trusted node identity.
+specific resource capabilities but do not create trusted node identity. The auth
+evaluator supports scoped KV write grants such as `kv.write_prefix:apps/foo/`
+for `kv.write_key:apps/foo/config` explain checks; command-level KV enforcement
+is still future work.
 
 ## Local State