diff --git a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
index 3fd9ba0..4db0aa1 100644
--- a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
+++ b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
@@ -156,6 +156,13 @@ directory login, replay denial, and cleanup. This task now awaits only the
 Binky user's own password choice, MFA enrollment, and final scoped-token
 acceptance.
 
+2026-07-29: the first portal attempt correctly denied cross-tenant access
+because KeyCape had not projected the established `net-kingdom-admins` group
+to the new platform-operator role. Commit `90a2078` adds and tests the explicit
+`tenant:platform` / `platform-operator` compatibility mapping and is deployed
+Ready. The operator must start a fresh OIDC session so the corrected claims
+are minted.
+
 ## Task: Register a workload-identity OIDC client for the qonto runtime
 
 ```task