diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 036b0a5..797202f 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -309,7 +309,7 @@
 | task | NK-WP-0053-T03 | wait | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | task | NK-WP-0053-T04 | todo | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | task | NK-WP-0054-T01 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
-| task | NK-WP-0054-T02 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
+| task | NK-WP-0054-T02 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T03 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T04 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T05 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
diff --git a/canon/standards/service-identity-privilege_v0.1.md b/canon/standards/service-identity-privilege_v0.1.md
index 8b2c661..01eea8c 100644
--- a/canon/standards/service-identity-privilege_v0.1.md
+++ b/canon/standards/service-identity-privilege_v0.1.md
@@ -3,14 +3,14 @@ id: netkingdom-service-identity-privilege
 type: standard
 title: "NetKingdom Service Identity and Privilege v0.1"
 domain: netkingdom
-status: proposed
+status: accepted
 version: "0.1"
 created: "2026-10-24"
-updated: "2026-10-24"
+updated: "2026-10-25"
 scope: service-account-governance
-revision: "draft-4"
+revision: "v0.1"
 owner: net-kingdom
-last_reviewed: "2026-10-24"
+last_reviewed: "2026-10-25"
 review_interval: 3m
 standard_token: service-identity-privilege_v0.1
 profiles:
@@ -30,9 +30,12 @@ related:
 
 ## 0. Status
 
-**Proposed, draft-4 (draft-3 approved in principle by the founder on 2026-10-24).** It binds nothing until it is ratified
-as v0.1 and each owner adopts it. Both owner replies are in (§10); ratification as v0.1 awaits the founder's decision on the corrections they
-produced.
+**Accepted, v0.1. Ratified by the founder on 2026-10-25.** The text is draft-4, unchanged by ratification: the
+founder approved draft-3 in principle on 2026-10-24, both owner replies arrived the same day (security-canon and
+railiance-platform; §10), and the corrections they produced were applied before ratification. Ratifying the
+standard does not apply any exception's elimination path, change any live service, or make a declaration
+owner-confirmed; each service owner still adopts it on their own schedule, and the declarations stay
+`owner_confirmed: false` until they do.
 
 - **draft-1** (2026-10-24): thirteen rules, naming, five initial exceptions, seven open questions.
 - **draft-2** (2026-10-24): the founder's review decided six points (§10), added the agent class and SI-14.
diff --git a/history/2026-10-24-security-identity-and-agent-review.md b/history/2026-10-24-security-identity-and-agent-review.md
index 155daa0..f3c5b0a 100644
--- a/history/2026-10-24-security-identity-and-agent-review.md
+++ b/history/2026-10-24-security-identity-and-agent-review.md
@@ -95,3 +95,11 @@ people accept. The founder is asked to accept or withdraw the card.
 `fix-consistency` where it would have touched another job's uncommitted files.
 
 Draft-4 of the standard applies the security-canon corrections and records the others; no founder decision changed.
+
+## Founder decisions, 2026-10-25
+
+- **Ratified** `canon/standards/service-identity-privilege_v0.1.md` as v0.1 (status accepted).
+- **Accepted** the emergent-security start card 0.2.7 (commit `8c903af`, digest
+  `22b7294e24137c0a350764b9cf37f3d4f2e9f35eb7c97a287d9c89477ef24d7a`) after reading the diff of the card text. The
+  acceptance is a human review of an agent-prepared change, recorded here and sent to emergent-security for its
+  EMERGENT-WP-0002 tracking. That commit is still local to that repository and is not pushed by net-kingdom.
diff --git a/tools/service-identity/README.md b/tools/service-identity/README.md
index 790db26..16ff1ef 100644
--- a/tools/service-identity/README.md
+++ b/tools/service-identity/README.md
@@ -2,9 +2,9 @@
 
 NK-WP-0054-T03. Offline and read-only. Checks declarations against
 `canon/schemas/service-identity_v0.1.schema.json` and evaluates the rules of the
-proposed [Service Identity and Privilege standard](../../canon/standards/service-identity-privilege_v0.1.md)
+accepted [Service Identity and Privilege standard](../../canon/standards/service-identity-privilege_v0.1.md)
 that a declaration alone can decide. It was built against draft-1, before the founder's review,
-so a rule change in the standard changes this tool. It follows draft-3.
+so a rule change in the standard changes this tool. It follows the accepted v0.1 text (draft-4).
 
 ```bash
 make service-identity-test    # unit tests
diff --git a/tools/service-identity/validate.py b/tools/service-identity/validate.py
index 7c3d5dc..46ff065 100644
--- a/tools/service-identity/validate.py
+++ b/tools/service-identity/validate.py
@@ -2,10 +2,10 @@
 # /// script
 # dependencies = ["jsonschema>=4.10,<5", "PyYAML>=6,<7"]
 # ///
-"""Check service identity declarations against the proposed standard (NK-WP-0054-T03).
+"""Check service identity declarations against the accepted standard (NK-WP-0054-T03).
 
 Validates `canon/schemas/service-identity_v0.1.schema.json`, then evaluates the rules of
-NetKingdom Service Identity and Privilege v0.1 (draft-3, a SecurityCanon profile) that a declaration alone can decide.
+NetKingdom Service Identity and Privilege v0.1 (v0.1, a SecurityCanon profile) that a declaration alone can decide.
 Each identity ends as `conformant`, `non-conformant`, `excepted` or `unknown`; unknown is a
 finding, not a pass. Observed state is the health check's job (T04), not this tool's.
 
@@ -98,7 +98,7 @@ NON_HUMAN = {"SERVICE", "WORKLOAD", "AGENT", "CONTROLLER", "DEVICE"}
 
 
 def _violations(identity: dict[str, Any]) -> tuple[set[str], list[str]]:
-    """Rules broken by one account on declared facts, and the facts still unknown (standard draft-3)."""
+    """Rules broken by one account on declared facts, and the facts still unknown (standard v0.1)."""
     broken: set[str] = set()
     unknown: list[str] = []
     principal = identity["principal_type"]
diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md
index b214741..d7c36aa 100644
--- a/workplans/NK-WP-0054-service-identity-policy.md
+++ b/workplans/NK-WP-0054-service-identity-policy.md
@@ -73,13 +73,10 @@ is an uninventoried legacy admin, and OpenBao `platform-admin` binds on a group
 
 ```task
 id: NK-WP-0054-T02
-status: wait
+status: done
 priority: high
 assignee: claude-code
 depends_on: [NK-WP-0054-T01]
-needs_human: true
-decision_id: "c926a190-8614-40b8-a20f-b017ef728db2"
-blocking_reason: "Both owner replies are in (security-canon, railiance-platform). Draft-4 applies them. Await the founder's ratification of v0.1 and answers to the post-review choices in the decision."
 state_hub_task_id: "5830e2eb-334a-52fa-9c55-a8c00d89c09f"
 ```
 
@@ -104,6 +101,10 @@ glas-harness and state-hub assessed the agent and attribution gaps (KEY-WP-0043,
 Draft-4 of the standard applies all of it without changing a founder decision. What remains for T02 is ratification:
 set the status to accepted when the founder decides.
 
+Completed 2026-10-25: the founder ratified the standard as v0.1 (status accepted). Ratification applies no exception's
+elimination path and changes no live service; owners adopt on their own schedule and the declarations stay
+unconfirmed until they do.
+
 Draft-3 (2026-10-24): realigned as an estate profile of SecurityCanon after a review against the canon
 (`history/2026-10-24-security-identity-and-agent-review.md`): imported vocabulary, SEC-DSM references per rule,
 estate identities in canon terms, new SI-15 (accountable automation). Validator migration is T08.