diff --git a/docs/proposals/authored-message-injection.md b/docs/proposals/authored-message-injection.md
index c19280c..b56f677 100644
--- a/docs/proposals/authored-message-injection.md
+++ b/docs/proposals/authored-message-injection.md
@@ -154,6 +154,21 @@ in the web surface + debug seed in the CLI. We commit to validating the
 primitive — including the event-silence contract and the `seeded` phase —
 end-to-end against the reference planes.
 
+## Consumer integration constraint (engine-imposed — Worldtree #347)
+
+The primitive is **Heimdall-gated with hide-existence** (a per-tenant policy
+decision — some tenants are never granted it, not a rollout stage). Ratatoskr's
+consumer side MUST tolerate per-tenant absence:
+
+- A granted tenant gets the sub-resource; an **ungranted tenant sees `404` (not
+  `403`)** — as if the feature never existed.
+- Treat `404` on the authored-history-write sub-resource as **"feature absent
+  for this tenant"** → fall back gracefully (no authored first-message; the
+  model-generated greeting), never surface it as an error or "denied."
+- **Do NOT capability-probe or advertise-detect** — the feature is deliberately
+  undiscoverable in `/capabilities` for ungranted tenants (same hide-existence
+  posture as the R27-V1A cross-owner pattern).
+
 ---
 
 *This brief was cold-read-pressure-tested by a cross-frontier panel (Grok /