diff --git a/workplans/KEY-WP-0014-native-credential-lane-handoff.md b/workplans/KEY-WP-0014-native-credential-lane-handoff.md
index d96cf3e..0f1306e 100644
--- a/workplans/KEY-WP-0014-native-credential-lane-handoff.md
+++ b/workplans/KEY-WP-0014-native-credential-lane-handoff.md
@@ -61,6 +61,36 @@ credentials. Integration tests exercise the real token/JWKS handlers and browser
 callback, including forged state, tampering, excess scope and unsafe output.
 See docs/native-authentication.md for invocation and ownership boundaries.
 
+
+2026-09-10. The authority question is answered and the blocker is narrowed to a
+schedulable act. railiance-platform named the executor (platform operator,
+attended founder session; explicitly not ops-warden, not secrets-engine
+autonomously, and no unattended agent), the transport (the governed
+`openbao-platform-admin-login` lane via `warden access ... --exec`), and the
+authority (founder_required attended OIDC, role=platform-admin). What is missing
+is a rotation CCR, which they will prepare *if KeyCape asks* — a two-custodian
+CAS rotation with a service restart being a distinct version-guarded operation
+rather than an implementation detail of an existing lane.
+
+**Not asked, deliberately.** Requesting a production credential rotation with a
+restart window is the operator's decision, not this repository's, so it was put
+to him rather than answered here (ops-warden msg 10fcc8af).
+
+Established before recommending anything either way: **this rotation has no
+incident driver.** KEY-WP-0011 recovered a real exposure on 2026-08-23, and the
+coordinated rotation that followed replaced the RS256 signing key, the LLDAP bind
+credential, the Authelia client credential and the privacyIDEA admin token. The
+`rapp-qonto` client secret was not in that payload — it is an `env:` secretRef
+resolved from a separate Kubernetes Secret, never inline in `config.yaml`, which
+config validation enforces. So this is lifecycle hygiene, not remediation, and
+nobody should be carrying it as leftover incident work. Hygiene can wait for a
+chosen window; remediation could not.
+
+Also recorded: `warden route`/`warden plan` previously returned a generic match
+that read as authorization, and offered read transports against a write need.
+This repository declined to act on it; railiance-platform independently called it
+a defect; fixed under WARDEN-WP-0038.
+
 ## Admit rotation and verify consumer handoff
 
 ```task