diff --git a/INTENT.md b/INTENT.md
new file mode 100644
index 0000000..08e9b8d
--- /dev/null
+++ b/INTENT.md
@@ -0,0 +1,98 @@
+# INTENT
+
+## Purpose
+
+This repository exists to provide a **lightweight, profile-conformant identity and access management (IAM) system** for the NetKingdom ecosystem.
+
+It ensures that applications can rely on a **stable, versioned authentication contract** independent of the underlying IAM implementation.
+
+---
+
+## Primary Utility
+
+The repository provides an implementation of the **NetKingdom IAM Profile** that:
+
+* Delivers OIDC/PKCE-based authentication with strong security constraints
+* Normalizes identity data across heterogeneous backend systems
+* Enforces strict adherence to a defined IAM contract
+* Enables seamless migration between lightweight and expanded IAM modes
+
+It transforms IAM from a system dependency into a **replaceable, contract-driven capability**.
+
+---
+
+## Intended Users
+
+* Application developers integrating against the NetKingdom IAM Profile
+* Infrastructure operators (`adm`) deploying IAM in constrained environments
+* Automation systems (`atm`) managing identity, migration, and validation workflows
+* LLM agents (`agt`) interacting with authenticated services
+
+---
+
+## Strategic Role in the System
+
+This repository serves as the **lightweight IAM layer** within NetKingdom:
+
+* It provides a **drop-in alternative to Keycloak** for environments with limited resources
+* It anchors IAM around a **profile contract rather than a specific implementation**
+* It enables a **two-mode architecture**:
+
+  * Lightweight mode (KeyCape)
+  * Expanded mode (Keycloak)
+
+The profile ensures that both modes are **interchangeable without application changes**.
+
+---
+
+## Strategic Boundaries
+
+This repository is **not** intended to:
+
+* Become a full-featured, general-purpose IAM platform
+* Extend beyond the defined NetKingdom IAM Profile
+* Support features that weaken security guarantees (e.g., implicit flow, wildcard redirects)
+* Replace or wrap Keycloak in expanded deployments
+
+Its responsibility is limited to **strict, secure, and transparent profile implementation**.
+
+---
+
+## Design Principles
+
+* **Contract over implementation**
+  Applications depend on the IAM profile, not on KeyCape internals
+
+* **Security through constraint**
+  Only explicitly allowed features are supported; unsafe patterns are rejected
+
+* **Explicitness over convenience**
+  Unsupported features must fail clearly and predictably
+
+* **Replaceability by design**
+  The system must be swappable with Keycloak without breaking integrations
+
+* **Canonical identity model**
+  Identity data must be normalized and consistent across all backends
+
+---
+
+## Maturity Target
+
+A mature version of this repository should:
+
+* Fully implement and enforce the **NetKingdom IAM Profile** with zero ambiguity
+* Provide **complete migration pathways** between lightweight and expanded modes
+* Offer **deterministic and testable behavior** across all supported scenarios
+* Act as a **reference implementation** of the IAM Profile
+* Enable IAM deployments that are **minimal, secure, and operationally efficient**
+
+---
+
+## Stability Note
+
+Changes to this file represent a **deliberate shift in the IAM contract, scope, or architectural role** of this repository.
+
+Such changes must be made with explicit intent, as they directly affect all dependent applications.
+
+