One declaration, with the derivedAudience recomputed at read time
rather than read from a column.

That recomputation is why the value here is always the one the verification path will require: nothing stores it, so changing the deployment's public edge URL cannot leave a stale audience behind on any row.

A TENANT-scoped issuer id answers 404, not 403. The

lookup names the DEPLOYMENT scope, so a customer's own declaration is simply not
reachable through this plane.

Never entitlement-gated. No Edition widens or narrows this plane. These are

the deployment operator's own declarations rather than a tenant's, so there is no
Edition to consult (FR-181.16).