Enforce local KV write capabilities

docs/architecture.md

@@ -111,8 +111,11 @@ through `db changes`. Loading cr-sqlite, applying remote changes, and DB sync
 are future work.
 
 `geth-kv` currently provides a SQLite-backed local fallback for named KV stores
-through `kv create/set/get`. Iroh Documents namespaces, prefix authorization
-enforcement, and replication are future work.
+through `kv create/set/get`. `kv set --subject <principal>` evaluates local auth
+ops for `kv.write_key:<key>` so prefix grants can be tested before networked
+callers exist. The local node/agent retains owner access for administration.
+Iroh Documents namespaces, remote caller identity, and replication are future
+work.
 
 `geth-document` currently registers local document resources and stores
 validated JSON state in the local SQLite metadata store through

docs/roadmap.md

@@ -237,7 +237,8 @@ authorization and durable-state boundaries clear.
   - `[x]` The auth evaluator allows `kv.write_prefix:<prefix>` grants to
     satisfy matching `kv.write_key:<key>` requests.
   - `[x]` Tests cover allowed and denied prefix-scoped KV write explanations.
-  - `[ ]` `geth kv set` enforces local capability decisions for the caller.
+  - `[x]` `geth kv set --subject <principal>` enforces local capability
+    decisions for non-local test callers.
   - `[ ]` KV metadata is replicated through Iroh Documents.
 
 - `[~]` Iroh-gossip pubsub integration.