diff --git a/SCOPE.md b/SCOPE.md
index a0f1585..e37ce20 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -342,3 +342,16 @@ description: >
   normalized execution evidence while leaving work-item lifecycle downstream.
 keywords: [temporal, workflow, event-bridge, ops-run, glas, task, report, evidence, cron, event, rule, instruction, org-automation]
 ```
+
+## Daily security-flow consumer
+
+`activity-definitions/daily-security-flow.md` supplies a fixed-command daily
+schedule for the Custodian security-flow runner (CUST-WP-0079-T03,
+ACTIVITY-WP-0047). Activity Core owns scheduling and ops_run evidence; the
+claiming workstation rein owns execution, and the Custodian script owns report
+and recipient checkpoint delivery. The definition carries no repository grant.
+
+The checked-in definition remains disabled pending workstation/hub acceptance,
+owner activation and the first unassisted fire. This source integration does
+not establish an active automation. Consumers can reuse the existing schedule,
+execution queue and profile contract rather than add another scheduler.