diff --git a/api/config/form_binding.php b/api/config/form_binding.php
new file mode 100644
index 00000000..02a1d248
--- /dev/null
+++ b/api/config/form_binding.php
@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+|--------------------------------------------------------------------------
+| Entity Column Registry (form builder binding targets)
+|--------------------------------------------------------------------------
+|
+| Authoritative whitelist of columns a form_field.binding may target.
+| Only listed columns are valid Pattern A (entity_owned) / Pattern C
+| (mirrored) binding targets — see ARCH-FORM-BUILDER.md §6.2.
+|
+| 'writable' gates Form Request validation at save time.
+| 'admin_only' hides the column from non-admin binding pickers.
+|
+*/
+
+return [
+
+    'user_profile' => [
+        'bio' => ['type' => 'text', 'label' => 'Bio', 'writable' => true],
+        'photo_url' => ['type' => 'image', 'label' => 'Profielfoto', 'writable' => true],
+        'emergency_contact_name' => ['type' => 'string', 'label' => 'Noodcontact naam', 'writable' => true],
+        'emergency_contact_phone' => ['type' => 'string', 'label' => 'Noodcontact telefoon', 'writable' => true],
+    ],
+
+    'person' => [
+        'first_name' => ['type' => 'string', 'label' => 'Voornaam', 'writable' => true],
+        'last_name' => ['type' => 'string', 'label' => 'Achternaam', 'writable' => true],
+        'email' => ['type' => 'string', 'label' => 'E-mail', 'writable' => true],
+        'phone' => ['type' => 'string', 'label' => 'Telefoon', 'writable' => true],
+        'date_of_birth' => ['type' => 'date', 'label' => 'Geboortedatum', 'writable' => true],
+        'admin_notes' => ['type' => 'text', 'label' => 'Notities', 'writable' => true, 'admin_only' => true],
+    ],
+
+    'company' => [
+        'contact_first_name' => ['type' => 'string', 'label' => 'Contact voornaam', 'writable' => true],
+        'contact_last_name' => ['type' => 'string', 'label' => 'Contact achternaam', 'writable' => true],
+        'contact_email' => ['type' => 'string', 'label' => 'Contact e-mail', 'writable' => true],
+        'contact_phone' => ['type' => 'string', 'label' => 'Contact telefoon', 'writable' => true],
+    ],
+
+    'artist' => [
+        // populated when artist module lands
+    ],
+
+    'organisation' => [
+        'name' => ['type' => 'string', 'label' => 'Organisatienaam', 'writable' => true],
+        'slug' => ['type' => 'string', 'label' => 'Slug', 'writable' => true],
+        'contact_name' => ['type' => 'string', 'label' => 'Contactpersoon', 'writable' => true],
+        'contact_email' => ['type' => 'string', 'label' => 'Contact-e-mail', 'writable' => true],
+        'phone' => ['type' => 'string', 'label' => 'Telefoon', 'writable' => true],
+        'website' => ['type' => 'string', 'label' => 'Website', 'writable' => true],
+    ],
+
+];
diff --git a/api/config/form_builder.php b/api/config/form_builder.php
new file mode 100644
index 00000000..d74e18c6
--- /dev/null
+++ b/api/config/form_builder.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+|--------------------------------------------------------------------------
+| Form Builder — general configuration
+|--------------------------------------------------------------------------
+|
+| Tunable limits, webhook policy, captcha, retention and feature flags for
+| the universal form builder. See ARCH-FORM-BUILDER.md §22.7 for rationale.
+|
+*/
+
+return [
+
+    'limits' => [
+        'max_fields_per_schema' => 100,
+        'max_filterable_fields_per_schema' => 20,
+        'max_options_per_field' => 100,
+        'max_submissions_per_public_schema_per_ip_per_hour' => 5,
+    ],
+
+    'webhooks' => [
+        'allowlist_domains' => [],
+        'blocklist_ips' => [
+            '127.0.0.0/8',
+            '10.0.0.0/8',
+            '172.16.0.0/12',
+            '192.168.0.0/16',
+            '169.254.169.254/32',
+        ],
+        'timeout_seconds' => 10,
+        'max_attempts' => 5,
+    ],
+
+    'file_uploads' => [
+        'default_allowed_mime_types' => ['image/jpeg', 'image/png', 'image/webp', 'application/pdf'],
+        'default_max_size_mb' => 5,
+    ],
+
+    'search_index' => [
+        'max_chars' => 10000,
+    ],
+
+    'captcha' => [
+        'provider' => 'turnstile',
+        'site_key' => env('TURNSTILE_SITE_KEY'),
+        'secret_key' => env('TURNSTILE_SECRET_KEY'),
+        'required_for_purposes' => ['public_complaint', 'public_press_request'],
+    ],
+
+    'public_submitter_ip_retention_days' => 30,
+
+    'user_profile_settings_whitelist' => [
+        'ui.theme',
+        'ui.sidebar_collapsed',
+        'ui.time_format',
+        'notifications.email_digest',
+        'notifications.shift_reminders',
+        'notifications.event_updates',
+    ],
+
+    'custom_field_types' => [],
+
+    'validation_callbacks' => [],
+
+    'features' => [
+        'webhooks' => false,       // dispatcher arrives in S6
+        'i18n_runtime' => false,   // runtime resolution later
+        'retention_job' => false,  // scheduler task later
+    ],
+
+];
diff --git a/api/config/form_filter_registry.php b/api/config/form_filter_registry.php
new file mode 100644
index 00000000..13ef1f6b
--- /dev/null
+++ b/api/config/form_filter_registry.php
@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+|--------------------------------------------------------------------------
+| Filter Registry — entity-column filter sources
+|--------------------------------------------------------------------------
+|
+| Defines filterable entity columns per list context (ARCH-FORM-BUILDER.md
+| §7.4). This is SEPARATE from the binding registry: not every bindable
+| column is filterable, and not every filterable column is bindable.
+|
+*/
+
+return [
+
+    'persons' => [
+        'crowd_type_id' => [
+            'label' => 'Crowd Type',
+            'field_type' => 'SELECT',
+            'options_source' => 'crowd_types',
+        ],
+        'status' => [
+            'label' => 'Status',
+            'field_type' => 'SELECT',
+            'options_enum' => \App\Enums\PersonStatus::class,
+        ],
+        'is_blacklisted' => [
+            'label' => 'Uitgesloten',
+            'field_type' => 'BOOLEAN',
+        ],
+    ],
+
+    'companies' => [
+        // populated as filters are needed
+    ],
+
+    'events' => [
+        // populated as filters are needed
+    ],
+
+];
diff --git a/api/config/form_subjects.php b/api/config/form_subjects.php
new file mode 100644
index 00000000..0f00fb24
--- /dev/null
+++ b/api/config/form_subjects.php
@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+|--------------------------------------------------------------------------
+| Subject Type Registry
+|--------------------------------------------------------------------------
+|
+| Authoritative list of subject_type values permitted on form_submissions.
+| Must match morph-map keys registered in AppServiceProvider.
+|
+| 'permission_check' format: '<PolicyClass>@<method>' — invoked to authorise
+| access to a submission for this subject. Omit when policy doesn't exist yet.
+|
+*/
+
+return [
+
+    'person' => [
+        'model' => \App\Models\Person::class,
+        'display_attribute' => 'name',
+        'permission_check' => \App\Policies\PersonPolicy::class.'@view',
+    ],
+
+    'user' => [
+        'model' => \App\Models\User::class,
+        'display_attribute' => 'name',
+        // TODO: add permission_check when UserPolicy is built (S2)
+    ],
+
+    'company' => [
+        'model' => \App\Models\Company::class,
+        'display_attribute' => 'name',
+        'permission_check' => \App\Policies\CompanyPolicy::class.'@view',
+    ],
+
+    'organisation' => [
+        'model' => \App\Models\Organisation::class,
+        'display_attribute' => 'name',
+        'permission_check' => \App\Policies\OrganisationPolicy::class.'@view',
+    ],
+
+    'event' => [
+        'model' => \App\Models\Event::class,
+        'display_attribute' => 'name',
+        'permission_check' => \App\Policies\EventPolicy::class.'@view',
+    ],
+
+    // 'artist' entry added when artist module lands
+
+];
diff --git a/api/config/queue.php b/api/config/queue.php
index 79c2c0a2..4b2205eb 100644
--- a/api/config/queue.php
+++ b/api/config/queue.php
@@ -73,6 +73,15 @@ return [
             'after_commit' => false,
         ],
 
+        'webhooks' => [
+            'driver' => 'redis',
+            'connection' => env('REDIS_QUEUE_CONNECTION', 'default'),
+            'queue' => env('WEBHOOKS_QUEUE', 'webhooks'),
+            'retry_after' => 120,
+            'block_for' => null,
+            'after_commit' => false,
+        ],
+
         'deferred' => [
             'driver' => 'deferred',
         ],