diff --git a/SCOPE.md b/SCOPE.md
index 40a2f54..985f364 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -213,7 +213,7 @@ Open product/policy workplan: **ACTIVITY-WP-0022** (IssueSink no-default-Forgejo
 | **G7. Credential delivery** | Low (residual) | **FORGEJO_TOKEN** via ESO `actcore-forgejo-admin` (WP-0023-T05, Ready). issue-core `GITEA_BACKEND_TOKEN` still 503 forgejo-inbox for path A rest — **issue-core owner** (WP-0023-T06). |
 | **G8. Live-images hygiene** | Medium (ops) | Multi-cluster `live-images-all.txt` must be refreshed after deploys or prune can delete live tags (incident 2026-07-21, restored). `scripts/refresh_live_images.sh` (T04). |
 | **G9. Evidence federation** | Low | Progress often lands on railiance01 edge/hub; workstation primary hub may not show the same feed without tunnel/outbox health. |
-| **G10. API external access** | Medium (mostly done) | WP-0025: Traefik + Authelia SSO live for `activity.coulomb.social` + `temporal.coulomb.social`; port-forward break-glass; residual T06 group allowlist. |
+| **G10. API external access** | Done | WP-0025 finished: Traefik + Authelia SSO for ops + Temporal UI; LLDAP `activity-core-operators` (NK-WP-0021); port-forward break-glass only. |
 
 ### Drift risks
 
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index c9dd254..973cacf 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -28,7 +28,7 @@
 | workplan | ACTIVITY-WP-0022 | finished | — | workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md |
 | workplan | ACTIVITY-WP-0023 | finished | — | workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md |
 | workplan | ACTIVITY-WP-0024 | finished | — | workplans/ACTIVITY-WP-0024-operator-automation-console.md |
-| workplan | ACTIVITY-WP-0025 | active | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| workplan | ACTIVITY-WP-0025 | finished | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | workplan | ADHOC-2026-06-01 | finished | — | workplans/ADHOC-2026-06-01.md |
 | workplan | custodian-WP-0001 | done | — | workplans/custodian-WP-0001-temporal-backbone.md |
 | workplan | custodian-WP-0002 | done | — | workplans/custodian-WP-0002-triggers-ops.md |
@@ -148,7 +148,7 @@
 | task | ACTIVITY-WP-0025-T03 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | task | ACTIVITY-WP-0025-T04 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | task | ACTIVITY-WP-0025-T05 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
-| task | ACTIVITY-WP-0025-T06 | wait | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T06 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | task | ACTIVITY-WP-0025-T07 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | task | ACTIVITY-WP-0025-T08 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | task | ADHOC-2026-06-01-T01 | done | — | workplans/ADHOC-2026-06-01.md |
diff --git a/docs/ops-sso-access.md b/docs/ops-sso-access.md
index c69af46..d704e80 100644
--- a/docs/ops-sso-access.md
+++ b/docs/ops-sso-access.md
@@ -47,16 +47,18 @@ Response headers trusted into the app:
 
 ### Access control policy
 
-Authelia global `default_policy: one_factor` currently applies. MVP accepts any
-authenticated Authelia user. Follow-up (T06) is filed as work-record intakes
-in **net-kingdom** (not hub-only notes):
+Authelia `default_policy: one_factor` for the fleet; **restricted hosts** use
+domain rules (NK-WP-0021, finished):
 
-| Intake | Scope |
+| Host | Rule |
 | --- | --- |
-| `NK-IN-0001` | LLDAP group `activity-core-operators` + membership runbook |
-| `NK-IN-0002` | Authelia domain rules for `activity` + `temporal` hosts |
+| `activity.coulomb.social` | allow `group:activity-core-operators`, else deny |
+| `temporal.coulomb.social` | allow `group:activity-core-operators`, else deny |
 
-See `net-kingdom/docs/intakes/activity-core-ops-sso-operators.md`.
+Membership: `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`  
+(`./manage-group-members.sh add <uid> activity-core-operators`).
+
+Intakes NK-IN-0001/0002 closed → promoted to **NK-WP-0021**.
 
 ## Mutation identity
 
diff --git a/docs/runbook.md b/docs/runbook.md
index 548da33..a3fe63d 100644
--- a/docs/runbook.md
+++ b/docs/runbook.md
@@ -120,6 +120,17 @@ the UI** — change definition files and sync.
 Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
 Mutations use SSO identity; shared token is break-glass only.
 
+**Who may log in:** LLDAP group `activity-core-operators` (Authelia domain
+rules — net-kingdom NK-WP-0021). Add/remove members:
+
+```bash
+# from net-kingdom checkout
+cd sso-mfa/k8s/lldap
+./manage-group-members.sh add <uid> activity-core-operators
+./manage-group-members.sh list activity-core-operators
+# full runbook: OPERATOR-GROUPS.md
+```
+
 **DNS (already set for TLS):**
 
 ```text
diff --git a/k8s/railiance/README.md b/k8s/railiance/README.md
index c5a42c9..67c934c 100644
--- a/k8s/railiance/README.md
+++ b/k8s/railiance/README.md
@@ -129,10 +129,10 @@ kubectl -n activity-core set env deploy/actcore-temporal-ui \
   TEMPORAL_CORS_ORIGINS=https://temporal.coulomb.social,http://localhost:8080,http://127.0.0.1:8080
 ```
 
-- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO)
+- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO; group `activity-core-operators`)
 - Temporal: https://temporal.coulomb.social
 - Design: `docs/ops-sso-access.md`
-- Follow-up: LLDAP group `activity-core-operators` + Authelia domain rules (T06)
+- Membership: `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md` (NK-WP-0021)
 
 ### Break-glass port-forward
 
diff --git a/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md b/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
index 70614be..a23875d 100644
--- a/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
+++ b/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
@@ -4,7 +4,7 @@ type: workplan
 title: "SSO access control for ops console and Temporal UI"
 domain: infotech
 repo: activity-core
-status: active
+status: finished
 owner: codex
 topic_slug: activity-core
 created: "2026-07-22"
@@ -170,7 +170,7 @@ token not required for normal operator use.
 
 ```task
 id: ACTIVITY-WP-0025-T06
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
 ```
@@ -182,6 +182,13 @@ state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
 **Done when:** login works for a test operator and fails for an unprivileged
 account.
 
+**Disposition (2026-07-22):** No new KeyCape/Keycloak OIDC client — fleet path
+is Traefik ForwardAuth → Authelia. Least-privilege group work implemented in
+**net-kingdom** `NK-WP-0021` (finished): LLDAP `activity-core-operators`,
+Authelia domain allow/deny for both public hosts, membership runbook
+`sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`. Intakes NK-IN-0001/0002 closed
+`promoted_to: NK-WP-0021`.
+
 ## Task: Docs and runbook cutover
 
 ```task
@@ -216,7 +223,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 ## Success criteria
 
 - [x] HTTPS SSO URLs for ops console and Temporal UI (no port-forward required)
-- [ ] Only authorized IdP group can access — **MVP: any Authelia user; T06 residual**
+- [x] Only authorized IdP group can access (`activity-core-operators` via NK-WP-0021)
 - [x] Ops mutations attribute to SSO identity; audits show principal (`sso:<user>`)
 - [x] Ops nav Temporal link points at SSO Temporal URL
 - [x] Runbook documents SSO primary + break-glass port-forward
@@ -253,7 +260,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 | T03 | done | Ingress + cert Ready; unauth → 302 auth.coulomb.social |
 | T04 | done | Temporal Ingress + cert Ready; `ACTIVITY_CORE_TEMPORAL_UI_URL` + CORS set |
 | T05 | done | SSO `Remote-User` preferred; token break-glass; tests + redeploy |
-| T06 | wait | LLDAP group activity-core-operators + Authelia domain rules (net-kingdom) |
+| T06 | done | NK-WP-0021 finished: LLDAP group + Authelia domain rules live |
 | T07 | done | Runbook + k8s README + design doc: SSO primary, port-forward break-glass |
 | T08 | done | See verification checklist below |
 
@@ -275,23 +282,20 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 | NetworkPolicy ingress→services | **skipped** (optional; ClusterIP + Authelia sufficient for MVP) |
 | Full browser login + Run now under real MFA session | **operator smoke** (credentials not in agent) |
 
-### Residual (keeps WP active)
+### Closeout 2026-07-22
 
-**T06** — restrict Authelia access to LLDAP group `activity-core-operators`
-(net-kingdom Authelia access_control rules). Until then any authenticated
-Authelia user can reach the UIs (org-wide SSO, not least-privilege).
+All tasks **done**. Workplan **finished**.
 
-**Work-record handoff (implementer = net-kingdom):**
+| Cross-repo | Result |
+| --- | --- |
+| NK-IN-0001 / NK-IN-0002 | closed, `promoted_to: NK-WP-0021` |
+| NK-WP-0021 | **finished** (LLDAP group, Authelia rules, OPERATOR-GROUPS.md) |
+| Authelia rules | `group:activity-core-operators` allow + domain deny for both hosts |
+| Membership | `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md` + `manage-group-members.sh` |
 
-| Intake | Owner repo | Scope |
-| --- | --- | --- |
-| `NK-IN-0001` | net-kingdom | LLDAP group `activity-core-operators` + membership runbook |
-| `NK-IN-0002` | net-kingdom | Authelia `access_control` domain rules for both public hosts |
+**Operator grant:** add users to `activity-core-operators` per net-kingdom runbook
+before first SSO login to the public UIs.
 
-Source file (canonical):
-`net-kingdom/docs/intakes/activity-core-ops-sso-operators.md`
-
-When both intakes are promoted/done, mark **T06** `done` and finish this WP.
-
-**Operator:** open https://activity.coulomb.social/ops/ui once, confirm inventory
-loads and a safe mutation (or dry path) shows `sso:<you>` in `/ops/audits`.
+**activity-core ownership remaining (ops, not open WP work):** break-glass
+port-forward + `ACTIVITY_CORE_OPERATOR_TOKEN`; keep Ingress/middleware in
+`k8s/railiance/30–32`.