diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index 4b9adf0..3dec27c 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -200,6 +200,23 @@ restart, env-only verify and a second `admin` login all passed
 ([evidence](../docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md)). Three of four binds are ESO-delivered;
 `keycape-config` no longer holds the bind password. Remaining: `svc-privacyidea` (resolver password stored in the
 privacyIDEA database, not a Secret key: needs its own design).
+
+**2026-10-31, `svc-privacyidea` design proposal (for founder decision):** privacyIDEA keeps the resolver `BINDPW`
+encrypted in its own database, and only `pi-admin` with a fresh MFA code can change it (`realm_bootstrap.py`), so
+neither ESO nor an unattended job can deliver it without a non-MFA admin credential (rejected: SI rules).
+Proposed: **OpenBao custody with attended write-through**, following CCR-2026-0028 (`attended-host-key-delivery`):
+1. bind-lane `svc-privacyidea setup`: the custody value must sign in to LLDAP as `svc-privacyidea` (LLDAP is the
+   authority for the current password; the working resolver proves privacyIDEA holds the same one), then KV
+   `directory-binds/svc-privacyidea` CAS=0, coding agents fenced. No Kubernetes role, no ESO, `runtime_access: false`.
+2. `realm_bootstrap.py --switch-bind --from-openbao`: reads the KV value in memory under the attended
+   `platform-admin` session and writes only `BINDPW` with `pi-admin` + MFA; the existing preservation checks apply.
+3. Rotation becomes: change the password in LLDAP, write the next KV version, run step 2, verify with an OTP login.
+   No custody decryption; the founder's MFA remains the gate.
+4. CCR-2026-0055 needs a request type for attended delivery into a service; railiance-platform's
+   `credential-change.py` gains it, modelled on `attended-host-key-delivery`.
+The done criterion of T04 then reads: three binds ESO-delivered, `svc-privacyidea` held in OpenBao with attended
+write-through. Alternative: keep it in founder custody as a recorded exception until privacyIDEA can read the
+resolver password from a file or environment.
    the env.
 
 ## Synthetic verification instead of a founder sign-in