Every tenant's trust posture, side by side — what the admission gate did on each isolated store, plus usage. Read-only; the admin key never touches tenant data paths.