SELF-ENROLLMENT AT EQUAL AUTHORITY. A credential that ALREADY holds business authority in a workspace (today: a legacy key) obtains its own machine identity with EXACTLY the same authority, with no human step: an enrollment that cannot widen authority needs no new approval, because moving a write from 'human owner actor, this authority' to 'machine actor, the same authority' grants nothing — it corrects a misattribution. The caller cannot name identity, workspace, actor, membership, grant, scopes, capabilities or authority; only an optional human-readable label, which names the identity and does not authorize it. This endpoint NEVER returns a Work Token: mint one with POST /identity/token. Idempotent per credential + workspace: a second call returns the SAME ids. A legacy→identity binding a human already made by hand is ADOPTED, never duplicated. After enrolling, business writes made with that same credential are attributed to the machine actor and never to the human owner; if a legacy_blanket grant existed for it, that grant is revoked (never mutated) and the issued grant carries supersedes_grant_id. An owner may revoke the enrollment; the revocation leaves a durable tombstone, after which this endpoint returns 403 self_enrollment_revoked until the owner explicitly re-enables it.