diff --git a/docs/evidence/2026-09-11-user-portal-tenant-policy.md b/docs/evidence/2026-09-11-user-portal-tenant-policy.md
new file mode 100644
index 0000000..5b4fe17
--- /dev/null
+++ b/docs/evidence/2026-09-11-user-portal-tenant-policy.md
@@ -0,0 +1,23 @@
+# Native User Engine tenant onboarding policy
+
+Owner coordination: NK-WP-0036-T03. Source dd8dd517438b876fdadf27770e3f7e7f55ea69cf,
+CI smoke run 159 and image publication run 160 succeeded.
+Tenant Engine PDP image:
+`forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd`.
+Only values/tenant-engine.yaml was promoted, Helm revision 3, readiness passed.
+Caller auth remains enforce, bound to the Tenant Engine ServiceAccount. Resources
+remain 25m CPU/32Mi requests. User Engine and other PDP releases did not move.
+
+Runtime checks used the deployed Tenant Engine client and its existing projected
+ServiceAccount token, kept inside its container. Requests named user-engine, the
+portal's actual service actor; no actor impersonation or human claims were used.
+Tenant create/read for tenant:trial:demo-company allow; platform tenant create/read,
+role grant, plan assign, retirement and guardrail set deny. Without a caller token
+the PDP returns 401. Policy checks perform no tenant mutations. Subsequent native
+User Engine adapter readback reports demo-company not found.
+
+Local checks: make test including Go race suite; 27 Rego tests and 35 fixtures;
+actual registry-enriched create matches v2. Rollback image remains
+`sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`.
+Rollback denies portal onboarding again; owner and guardrail-reader grants retain
+their prior semantics. Real operator onboarding is tracked by RAPPS-WP-0014.
diff --git a/values/tenant-engine.yaml b/values/tenant-engine.yaml
index 3715574..ea95f87 100644
--- a/values/tenant-engine.yaml
+++ b/values/tenant-engine.yaml
@@ -4,7 +4,7 @@
 name: flex-auth-tenant-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
+  digest: sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd
 args:
   - serve
   - --addr