diff --git a/enbox/architecture.md b/enbox/architecture.md
index 2bcaac0..3a56fd5 100644
--- a/enbox/architecture.md
+++ b/enbox/architecture.md
@@ -54,7 +54,7 @@ Replication feeds messages back through the same admission semantics rather than
 - **DWN engine**: message parsing, validation, authorization, Records/Protocols/Messages handlers.
 - **Stores**: durable messages, data, feed metadata, resumable tasks.
 - **Identity/signatures**: DID resolution and JWS verification.
-- **Agent/runtime**: link planning, sync orchestration, session state, remote transport.
+- **Agent/runtime**: link planning, sync orchestration, session state, remote transport. Rust owner: `dwn-rs-agent` (agent identity/vault, `auth` registration/connect); reference: `@enbox/agent` with `@enbox/auth` above it.
 - **Encryption control**: record envelope primitives plus higher-level key-distribution/control records.
 - **Transport/topology**: JSON-RPC/HTTP/WS, endpoint discovery, forwarding, proxying.
 
diff --git a/enbox/package-map.md b/enbox/package-map.md
index 0e7ff44..cf84115 100644
--- a/enbox/package-map.md
+++ b/enbox/package-map.md
@@ -34,13 +34,17 @@ crates/
     events/
     filters/
     handlers/
-    identity/
     interfaces/
     permissions/
     runtime/
     stores/
     sync/
 
+  dwn-rs-agent/
+    agent/      (identity, vault key lifecycle, secret-store traits)
+    auth/       (tenant registration/setup, legacy connect/delegate helpers)
+    sqlite secret-store backend (feature `sqlite`)
+
   dwn-rs-stores/
     sqlite-backed stores
     native node assembly
@@ -65,7 +69,9 @@ handlers/
 
 - `handlers/records/common.rs` currently carries substantial shared Records validation/admission logic.
 - `permissions/mod.rs` carries a large portion of Permission Grant authorization.
-- store traits live in core; SQLite implementations live in `dwn-rs-stores`.
+- store traits live in core; SQLite implementations live in `dwn-rs-stores`. Exception: agent secret/key backend traits (`SecretStore` and related seams) live in `dwn-rs-agent`; the `agent_secrets` schema is currently defined by the `dwn-rs-stores` migration.
+- Agent identity, tenant registration/setup, and connect helpers live in `dwn-rs-agent` (`agent/`, `auth/`); `dwn-rs-core` no longer carries `identity/`.
+- Dependency direction is `dwn-rs-agent` → `dwn-rs-stores`, never the reverse; this is load-bearing for vault and DWN-backed-store work, where secret-schema and file ownership get revisited.
 - durable feed ownership belongs to the message store; the event-log adapter observes that feed rather than maintaining a second authoritative history.
 - sync orchestration should move toward the durable-feed model owned by `MessagesQuery`/`MessagesSubscribe`, not legacy `MessagesSync`/`StateIndex`.
 
diff --git a/glossary.md b/glossary.md
index cf3c73c..68cfb09 100644
--- a/glossary.md
+++ b/glossary.md
@@ -1,5 +1,11 @@
 # Glossary
 
+## Agent (runtime)
+The Enbox user-agent: the DID, key manager, and secret store acting for one user. Rust owner: `dwn-rs-agent`. Distinct from a delegated agent principal.
+
+## Delegated agent (principal)
+A software/AI principal acting under a permission grant. Described by protocol and permission types, not by the agent runtime crate.
+
 ## Author
 The semantic principal on whose behalf a DWN message acts. With author delegation, the Author can differ from the cryptographic Signer.