diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index f945190..271f2fe 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -47,6 +47,7 @@
 | workplan | FLEX-WP-0035 | finished | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
 | workplan | FLEX-WP-0036 | active | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
 | workplan | FLEX-WP-0037 | finished | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
+| workplan | FLEX-WP-0038 | ready | — | workplans/FLEX-WP-0038-wave2-resource-right-sizing.md |
 | task | FLEX-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
 | task | FLEX-WP-ADHOC-2026-10-03-T02 | wait | — | workplans/ADHOC-2026-10-03.md |
 | task | FLEX-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
@@ -229,6 +230,7 @@
 | task | FLEX-WP-0037-T01 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
 | task | FLEX-WP-0037-T02 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
 | task | FLEX-WP-0037-T03 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
+| task | FLEX-WP-0038-T01 | wait | — | workplans/FLEX-WP-0038-wave2-resource-right-sizing.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md b/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md
new file mode 100644
index 0000000..8ea24a6
--- /dev/null
+++ b/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md
@@ -0,0 +1,43 @@
+---
+id: FLEX-WP-0038
+type: workplan
+title: "Wave-2 resource right-sizing for the flex-auth runtime"
+domain: infotech
+repo: access-engine
+status: ready
+flavor: implementation
+owner: access-engine
+created: "2026-10-21"
+updated: "2026-10-21"
+related: [CUST-WP-0071, RESOURCE-WP-0008]
+---
+
+# Wave-2 resource right-sizing for flex-auth
+
+Receiving record for the node-level allocation review of RESOURCE-WP-0008
+(resource-control `3d9b1bd`). Evidence:
+`resource-control/docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.{md,json}`.
+The founder placed this task in access-engine, beside `charts/flex-auth`, on
+2026-10-21 (`the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`).
+
+```task
+id: FLEX-WP-0038-T01
+status: wait
+priority: low
+needs_human: true
+blocking_reason: "Wave-2 cluster write needs founder approval (2026-10-21 interview)."
+```
+
+| Workload | Pods | CPU request (m) | CPU limit (m) | 7d CPU p95/peak (m) | Memory request (Mi) | 7d memory p95/peak (Mi) |
+|---|---:|---|---:|---|---|---|
+| flex-auth/flex-auth | 9 | 145 → 45 | 2700 | 2.2 / 18.6 | 288 → 176 | 140 / 191 |
+
+Proposed values follow the review rule: the largest of p95×1.5, peak×0.5 and the
+per-pod floor. Spread them across the 9 pods in the chart's existing resource
+values (`charts/flex-auth/values.yaml`). Find the deployed values override first,
+and check that the chart actually produces the live objects.
+
+Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hours,
+authorization decision latency is unchanged, and the next weekly allocation report
+shows no CPU throttling. Rollback: revert the values commit and redeploy through
+the existing path.