Name the initiator where the fields a rule can use are listed

app/src/routes/_authed/admin/boundaries.tsx

@@ -178,9 +178,13 @@ function BoundariesPage() {
             <code>key</code> being pressed, the file being touched, the{" "}
             <code>command</code> being run, and <code>mcp.server</code>,{" "}
             <code>mcp.tool</code> and <code>mcp.effect</code> for a call to
-            somebody else&rsquo;s tools. A rule that cannot be evaluated counts
-            as a match, so a mistyped deny refuses rather than quietly
-            permitting what it was meant to forbid.
+            somebody else&rsquo;s tools. <code>initiator.kind</code> says what
+            started the run &mdash; <code>person</code>, <code>routine</code> or{" "}
+            <code>handoff</code> &mdash; which <code>actor.id</code> cannot,
+            because a scheduled run carries its owner&rsquo;s authority while
+            nobody is watching. A rule that cannot be evaluated counts as a
+            match, so a mistyped deny refuses rather than quietly permitting
+            what it was meant to forbid.
           </>
         }
         title="It may never"

docs/architecture.md

@@ -58,6 +58,11 @@ Policy rules can inspect:
 - `command`
 - `file.path`, `file.name`, `file.extension`
 - `mcp.server`, `mcp.tool`, `mcp.effect`
+- `initiator.kind`, `initiator.id` — what started the run, as distinct from whose
+  authority it carries. `person`, `deployment`, `routine` or `handoff`, with the
+  routine or Bot id where there is one. `actor.id` is the routine's owner on a
+  scheduled run, so this is the only field that can tell an unattended run from
+  somebody typing.
 
 Rules use CEL expressions plus case-insensitive `contains()` and `matches()`.
 Deny rules are evaluated before allow rules. The policy engine fails closed: a