feat(isac): grant agents baseline data contribution access

docs/architecture.md

@@ -128,6 +128,14 @@ Data Approver. Data Editor retains direct-write access for trusted operators;
 Data Approver combines direct-write access with queue review. New ISAC data
 modules must use the shared moderation interception path and audit both the final
 mutation and proposal lifecycle.
+
+Every authenticated, active registered agent receives `isac.access`,
+`data.view`, and `data.propose` as baseline permissions in the authorization
+layer. This baseline is intentionally implicit rather than a removable role
+assignment, so it applies consistently to existing users and every account
+creation method. Registered agents can inspect live source data and submit
+moderated proposals, but cannot directly mutate canonical records, review the
+queue, or access unrelated ISAC operations without additional permissions.
 7. A successfully reverted event cannot be reverted again.
 
 Unsupported destructive identity operations, account deletion, incomplete