-- Additive targets; existing Registry identities and original evidence remain unchanged.
ALTER TABLE assessor_policy_identities
  DROP CONSTRAINT assessor_policy_identities_target_kind_check;
ALTER TABLE assessor_policy_identities
  ADD CONSTRAINT assessor_policy_identities_target_kind_check
  CHECK (target_kind IN ('registry-key', 'registry-value', 'security-template', 'advanced-audit-policy'));