diff --git a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md
index 0bb90a8..0cf51b1 100644
--- a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md
+++ b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md
@@ -100,6 +100,13 @@ The helper image is digest-pinned and the service is non-root, read-only, and
 NetworkPolicy restricted. Binky's user-chosen password and MFA acceptance
 remain.
 
+2026-07-29 correction: live platform-root access exposed that the established
+`net-kingdom-admins` bootstrap group was not mapped into the newer IAM
+envelope. KeyCape `90a2078` now maps that group explicitly to
+`tenant:platform` plus `platform-operator`, with regression coverage, while
+tenant-admin mappings remain tenant scoped. The fixed image is Ready on
+railiance01.
+
 ## T04 - Integrate authorization, email, audit, and events
 
 ```task