Install Global Profiles

Profiles are versioned interpretation/constraint material. Install them as controlled configuration, not as editable policy snippets.

1. Pin the ENTITY release/profile source.
2. Verify the profile registry/package hashes/signatures where provided.
3. Install the exact profile versions required by the deployment.
4. Set organization-specific configuration outside immutable sealed payloads where required.
5. Run valid/invalid fixtures.
6. Record installed profile IDs/versions in deployment evidence.

Upgrades

Installing a new profile version must not silently change the interpretation of historical signed passports. Keep older profile versions available for verification.

Authority boundary

A profile cannot grant authority that the Entity/rights state does not already authorize.