Local control surface for Authentik identity, Convex workspace scope, and time-agent runtime delegation.