diff --git a/docs/anthropic-workload-key.md b/docs/anthropic-workload-key.md
index 5331e89..4a9f83d 100644
--- a/docs/anthropic-workload-key.md
+++ b/docs/anthropic-workload-key.md
@@ -10,12 +10,12 @@ passes and apply-plan refuses the incomplete request.
 
 | Setting | Proposed value |
 | --- | --- |
-| Anthropic organization | Awaiting user selection |
+| Anthropic organization | `e1a8f305-9e64-4639-a7fd-af48e34f37c7` (user supplied) |
 | Dedicated workspace | `glas-harness` |
 | Workspace spend limit | Awaiting user selection |
-| Service account / key label | `glas-agent-dev` |
+| Provider key name | `claude_key_bernd.worsch` (user supplied; account type unverified) |
 | Key scope | Only the dedicated workspace |
-| Initial expiry | 30 days, subject to organization policy |
+| Provider expiry | `2027-01-31T22:00:00+01:00` = `2027-01-31T21:00:00Z` (user supplied) |
 | KV-v2 entry | `platform/workloads/glas-harness/claude-agent-dev` |
 | Only secret field | `ANTHROPIC_API_KEY` |
 | Read policy name | `workload-kv-read-glas-claude-agent-dev` |
@@ -24,7 +24,8 @@ passes and apply-plan refuses the incomplete request.
 
 These are proposed coordinates, not evidence that provider/OpenBao objects
 exist. The generic `openbao-api-key` routing entry is not a usable grant.
-No provider key or live auth role was created in this preparation.
+Provider key metadata was supplied by the user. OpenBao empty version 1 now
+exists; no live auth role or runtime grant was created.
 
 ## Provider creation and custody
 
@@ -66,3 +67,26 @@ For rotation, create and store a replacement with CAS, stop runs carrying the
 predecessor, verify the replacement, revoke the predecessor at Anthropic and
 prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key.
 For compromise, disable the provider key immediately and stop affected runs.
+
+## Empty-version UI handoff
+
+User authorized an empty version at the proposed path. The platform initializer
+`scripts/prepare-glas-anthropic.py` writes only an empty `ANTHROPIC_API_KEY`
+using CAS zero, then records non-secret provider metadata. It never reads data
+and does not create any reader policy or auth role. A contained operator login
+is required; the local ops-mason grant is absent and its builder policy denies
+data writes. Creation receipt is `/tmp/glas-anthropic-empty-receipt.json`.
+Do not assume creation succeeded without that receipt and a successful envelope.
+
+After confirmed creation, open mount `platform`, path
+`workloads/glas-harness/claude-agent-dev`, and create a new version replacing
+the empty `ANTHROPIC_API_KEY` with the real key. The recorded provider expiry
+is descriptive metadata, not an OpenBao-enforced expiration. Do not send the
+value back in chat. Workspace/budget and runtime delivery remain unverified.
+
+Creation confirmed 2026-09-05: empty version 1, request id
+`50cafc25-8d24-c1d6-5be8-1ade049e088b`. Metadata completion succeeded through
+a second contained login after correcting empty-response parsing; both sessions
+were revoked. See the non-secret evidence in
+`evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json`.
+The user can now create version 2 in the UI.
diff --git a/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json
new file mode 100644
index 0000000..3252367
--- /dev/null
+++ b/docs/evidence/GLAS-WP-0012-anthropic-empty-entry-2026-09-05.json
@@ -0,0 +1,8 @@
+{
+  "ccr": "CCR-2026-0016",
+  "path": "platform/data/workloads/glas-harness/claude-agent-dev",
+  "version": 1,
+  "empty_seed_created": true,
+  "metadata_written": true,
+  "request_id": "50cafc25-8d24-c1d6-5be8-1ade049e088b"
+}