The custody axis

Custody and visibility modeled as separate properties of a shared container rather than as one. Custody names who owes the terminal duties, concluding the container, suspending it, answering for a departing member, initiating erasure when erasure is owed. Visibility names who may read what is inside. The separation is structural rather than conventional only when read policies are forbidden from referencing the custodian at all, which removes the shortcut instead of denying it by default and permitting it later. Where the two collapse into one column, a read path arrives attached to a duty nobody requested it with, and the role becomes a privilege that can only be given to whoever the group already trusts to read rather than to whoever is best placed to keep.