docs: define BYOC at the customer-controlled boundary

docs/commercial/deployment-boundaries.md

@@ -57,9 +57,11 @@ flowchart LR
 ### Lane 2: Customer-controlled runner
 
 - **What runs where:** execution runs on infrastructure the customer controls
-  (workstation, server, VM, or customer cloud account). This is the standard
-  lane for regulated or sensitive workflows, including the published RVU audit
-  case study deployment shape.
+  (workstation, server, VM, or customer cloud account). A customer-owned cloud
+  runner and storage boundary can use the existing
+  [bring your own cloud (BYOC)](../reference/glossary.md#byoc) connector. This
+  is the standard lane for regulated or sensitive workflows, including the
+  published RVU audit case study deployment shape.
 - **Where sensitive data lives:** live frames, OCR text, injected parameters,
   and verifier values stay inside the customer boundary. If PHI appears on
   screen at run time, it never leaves.

docs/commercial/execute-api.md

@@ -8,6 +8,16 @@ and waits for a terminal receipt.
 This guide is for an approved private-pilot partner. OpenAdapt supplies the
 service credential and the identifiers from the qualification pack.
 
+## Choose where execution runs
+
+Execute can dispatch to an approved managed runner or to a customer-controlled
+runner. A customer-owned cloud runner and storage boundary can use the existing
+[bring your own cloud (BYOC)](../reference/glossary.md#byoc) connector. The
+customer runner executes the workflow. Cloud carries bounded authorization and
+control metadata and receives only the declared result and evidence allowed by
+the data boundary. Other customer-controlled deployments can use a workstation,
+server, or on-premises virtual machine without using BYOC.
+
 ## Authenticate the service
 
 OpenAdapt issues one service token. The token is restricted to one organization

docs/concepts/deployment-matrix.md

@@ -9,7 +9,7 @@ schema. What differs across lanes is data handling, not substrate capability.
 | Deployment / substrate | Browser | Windows UIA | Native macOS | Native Linux | RDP | Citrix / VDI |
 |---|---|---|---|---|---|---|
 | **OpenAdapt Hosted** | Managed execution, schedules, reports, usage, and billing | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud | Customer-controlled runtime connected to Cloud |
-| **Customer cloud / BYOC** | Customer runner and storage with managed governance | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage |
+| **Customer cloud / bring your own cloud (BYOC)** | Customer runner and storage with managed governance | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage | Customer runner and storage |
 | **Self-hosted / on-prem** | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail | Local runner and audit trail |
 
 Every substrate is a first-class target of the shared compiler, runner, and
@@ -27,6 +27,13 @@ entitlement. The matrix describes the product architecture; the
 [qualification appendix](../get-started/what-works-today.md) and commercial terms
 define the accepted workload and entitlement.
 
+In the existing BYOC connector and configuration, a runner and storage inside a
+customer-owned cloud boundary execute the workflow. OpenAdapt Cloud can send
+bounded authorization and control metadata and receive the declared result and
+evidence permitted by the data boundary. Other customer-controlled deployments
+can run on a workstation, server, or on-premises virtual machine without being
+BYOC. See the [glossary](../reference/glossary.md#byoc).
+
 ## Artifact boundary and runtime boundary
 
 Two boundaries must be reviewed independently:

docs/reference/glossary.md

@@ -0,0 +1,23 @@
+# Glossary
+
+Short definitions for terms used across OpenAdapt.
+
+## BYOC
+
+**Bring your own cloud (BYOC)** is the existing OpenAdapt connector and
+configuration name for a customer-owned cloud runner and storage boundary.
+
+OpenAdapt Cloud can send bounded authorization and control metadata to that
+runner. Cloud receives only the declared result and evidence permitted by the
+deployment data boundary. Live screenshots, sensitive parameters, and verifier
+values can remain inside the customer boundary.
+
+The broader public term is **customer-controlled execution**. A
+customer-controlled runner can also run on a workstation, server, or
+on-premises virtual machine. Those deployments do not have to use BYOC.
+
+BYOC does not mean bring your own compute. It does not mean customer-provided
+source code. It does not grant unrestricted access to OpenAdapt Cloud.
+
+See [Deployment boundaries](../commercial/deployment-boundaries.md) and
+[Integrate OpenAdapt Execute](../commercial/execute-api.md).

mkdocs.yml

@@ -181,6 +181,7 @@ nav:
     - Deployment configuration: reference/deployment-config.md
     - The bundle format: reference/bundle-format.md
     - Configuration and env vars: reference/configuration.md
+    - Glossary: reference/glossary.md
     - Package and repository lifecycle: ecosystem/index.md
     - Documentation source of truth: reference/documentation-governance.md
     - What's New: whats-new.md