Enforce local KV write capabilities

AGENTS.md

@@ -113,8 +113,9 @@ Roadmap items should be actionable and checkable:
   users, devices, nodes, agents, and endpoint bindings.
 - The auth reducer builds a current permission view for resources, grants,
   groups, and bearer access. The daemon persists local auth grant/revoke ops
-  and uses them for `auth explain`. Signature validation and daemon-side module
-  enforcement are still roadmap work.
+  and uses them for `auth explain`. `kv set --subject <principal>` enforces
+  local KV write grants for non-local test callers. Signature validation and
+  broader daemon-side module enforcement are still roadmap work.
 - The daemon persists local keychain init/admin-key ops and reduces them for
   `keychain status`. SSH signature capture/verification is still roadmap work.
 - Local CAS supports pin/unpin metadata, surfaced through `cas list`, and