A template can issue; an endpoint decides who gets to ask, through which door. Every enrollment interface — REST, ACME, and the roadmap protocols alike — is a versioned config resource with a unique URL/path, one defaultTemplate, an optional templates allowlist, assignment to head instances (assignedTo: a role, role@site, or one instance), an authentication policy and permissions for issue, renew and revocation. The endpoint's logical CA comes from its template binding — so generation rollover is invisible to clients.
Endpoint lint keeps the wiring honest: it rejects a template whose CA binding excludes the endpoint, system service templates, and an assignment that cannot match any component. Unassigned endpoints remain visible as unhealthy configuration rather than going silently dead.
sourceRanges. The enrollment path reads and enforces enabled, defaultTemplate, templates and permissions. sourceRanges, trustedProxies, assignedTo and the per-endpoint limits are stored and versioned but read by nothing — a document restricting an endpoint to one CIDR restricts nothing today, and it fails open. Restrict source addresses in your own network layer and treat the field as documentation of intent until the manual's note disappears.Now I can wire a template to the door that serves it — and I know which endpoint fields actually enforce.