The verdict the tenant's OWN surface is gated on — exposed here as a READ so an
operator provisioning on a tenant's behalf knows whether that tenant can also do it
themselves.

It gates nothing on this plane. A negative verdict does not stop the

operator writing; it tells them they will remain the only writer. The lever that
changes the verdict is the Edition assignment
(PUT /api/v3/admin/platform/tenants/{tenantId}/key-backend/edition),
which is where a licensing change belongs.

The tenant-plane twin of this endpoint answers 403 for a SaaS operator, which is the whole reason this one exists.

resolution is required reading beside the verdict: LICENSED means the licence answered, FLOORED means it

could not be read and the reply is the fail-closed floor. "Their edition does not
include this" and "we could not confirm their edition" are two different
conversations.