Fix up comments and improve readability

client/internal/ipcauth/interceptor.go

@@ -46,6 +46,13 @@ func (i *Interceptor) StreamServerInterceptor() grpc.StreamServerInterceptor {
 	}
 }
 
+// authorize decides each RPC from the caller's identity, first match wins:
+//
+//  0. no identity                    DENY
+//  1. self / privileged / forwarded  ALLOW (root, elevated, daemon-self, JSON gateway)
+//  2. in ownersAuthorizedMethods     owner tier   (gate on DaemonOwnership)
+//  3. in handlerAuthorizedMethods    profile tier (bypass, handler decides)
+//  4. everything else                default tier (gate on ActiveProfileOwnership)
 func (i *Interceptor) authorize(ctx context.Context, fullMethod string) error {
 	id, ok := IdentityFromContext(ctx)
 	if !ok {

client/internal/ipcauth/interceptor_test.go

@@ -56,13 +56,15 @@ func ctxWith(id Identity) context.Context {
 }
 
 const (
-	up      = servicePath + "Up"
-	list    = servicePath + "ListProfiles"
-	unkwn   = servicePath + "SomeFutureMethod"
-	down    = servicePath + "Down"
-	statusm = servicePath + "Status"
-	addp    = servicePath + "AddProfile"
-	switchp = servicePath + "SwitchProfile"
+	up       = servicePath + "Up"
+	list     = servicePath + "ListProfiles"
+	unkwn    = servicePath + "SomeFutureMethod"
+	down     = servicePath + "Down"
+	statusm  = servicePath + "Status"
+	addp     = servicePath + "AddProfile"
+	switchp  = servicePath + "SwitchProfile"
+	addowner = servicePath + "AddOwner"
+	sharep   = servicePath + "ShareProfile"
 )
 
 func TestInterceptorAuthorize(t *testing.T) {
@@ -107,6 +109,11 @@ func TestInterceptorAuthorize(t *testing.T) {
 		{"add by daemon owner allowed", Ownership{}, Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 1000}), addp, false},
 		{"add by non-owner denied", Ownership{}, Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), addp, true},
 		{"owner-tier TOFU claims unowned daemon", Ownership{}, Ownership{}, nil, ctxWith(Identity{UID: 2000}), down, false},
+
+		// Owner-set mutations gate on daemon ownership, not the active profile.
+		{"add-owner by daemon owner allowed", Ownership{Owners: []string{"uid:9"}}, Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 1000}), addowner, false},
+		{"add-owner by active-profile owner (non daemon owner) denied", Ownership{Owners: []string{"uid:2000"}}, Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), addowner, true},
+		{"share by active-profile owner (non daemon owner) denied", Ownership{Owners: []string{"uid:2000"}}, Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), sharep, true},
 	}
 
 	for _, tt := range tests {

client/internal/ipcauth/policy.go

@@ -26,22 +26,22 @@ type ProfilePolicy interface {
 	ClaimDaemonOwnerIfUnowned(id Identity) (bool, error)
 }
 
-// ownersAuthorizedMethods require a daemon-wide owner (or root). They are
-// daemon-level operations independent of any single profile: creating profiles,
-// tearing down the connection, and reading daemon status.
+// ownersAuthorizedMethods gate on the daemon-wide owner set (or root): daemon-level
+// ops independent of any profile. The owner-set mutations (AddOwner, ShareProfile,
+// ResetOwner) must gate here, not on the active profile, else a per-profile owner
+// could escalate via `owner add`. ResetOwner also requires root in its handler.
 var ownersAuthorizedMethods = map[string]bool{
-	servicePath + "AddProfile": true,
-	servicePath + "Down":       true,
-	servicePath + "Status":     true,
+	servicePath + "AddProfile":   true,
+	servicePath + "Down":         true,
+	servicePath + "Status":       true,
+	servicePath + "AddOwner":     true,
+	servicePath + "ShareProfile": true,
+	servicePath + "ResetOwner":   true,
 }
 
-// handlerAuthorizedMethods bypass the active-profile gate. Peer identity is still
-// required to reach them. They either self-authorize in the handler against the
-// profile they target (SwitchProfile, RemoveProfile, RenameProfile via
-// authorizeTargetProfile) or against the caller's own profiles (ListProfiles via
-// bindCallerUsername), or return only non-sensitive metadata that any local user
-// may read (GetActiveProfile: the active profile's id, name, and owning username,
-// so the CLI can show which profile, and whose, holds the daemon).
+// handlerAuthorizedMethods bypass the ownership gate (identity still required)
+// and let the handler authorize. GetActiveProfile bypasses only to return
+// public metadata any local user may read.
 var handlerAuthorizedMethods = map[string]bool{
 	servicePath + "ListProfiles":     true,
 	servicePath + "RemoveProfile":    true,
@@ -71,6 +71,9 @@ var auditMethods = map[string]bool{
 	servicePath + "Logout":             true,
 	servicePath + "CleanState":         true,
 	servicePath + "DeleteState":        true,
+	servicePath + "AddOwner":           true,
+	servicePath + "ResetOwner":         true,
+	servicePath + "ShareProfile":       true,
 }
 
 // ConfigAdapter is a ProfilePolicy whose backend is set lazily, once the daemon