diff --git a/.custodian-brief.md b/.custodian-brief.md
index 217a786..9d2cae8 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,21 @@
 # Custodian Brief — activity-core
 
 **Domain:** infotech  
-**Last synced:** 2026-07-21 21:20 UTC  
+**Last synced:** 2026-07-21 22:49 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### SSO access control for ops console and Temporal UI
+Progress: 2/8 done  |  workplan_id: `c4e48358-df12-4bf4-9916-0e93f05f5fcf`
+
+**Open tasks:**
+- ! Task: Keycloak client and group membership  `b14e1f2c`
+- ► Task: Ingress + TLS for ops API (read path)  `7084f7d5`
+- ► Task: Ingress + SSO for Temporal Web UI  `99b36f31`
+- ► Task: Map SSO identity into ops mutations  `77fff202`
+- ► Task: Docs and runbook cutover  `c5945e64`
+- · Task: Verify and harden  `f73eafbf`
 
 ---
 ## MCP Orientation (when available)