diff --git a/sso-mfa/k8s/keycape/README.md b/sso-mfa/k8s/keycape/README.md
index 730a0db..fd05f03 100644
--- a/sso-mfa/k8s/keycape/README.md
+++ b/sso-mfa/k8s/keycape/README.md
@@ -169,9 +169,12 @@ KeyCape:
 bash ./configure-openbao-oidc.sh
 ```
 
-That script registers the browser UI callbacks on the OpenBao
-`auth/netkingdom/role/platform-admin` role and the compatibility
-`auth/keycape/role/platform-admin` role. Browser operators should use the
+That script enables and configures the OpenBao `netkingdom` and compatibility
+`keycape` OIDC mounts. It never writes the `platform-admin` role: the role's
+policies, callbacks and bound claims are declared centrally by
+railiance-platform at `openbao/auth/netkingdom-platform-admin-role.json`, and
+the script fails if the declared role is missing. Any additional allowance
+belongs in that declaration, not here. Browser operators should use the
 OpenBao UI at `http://127.0.0.1:18200` through the named
 `openbao-ui-railiance01` tunnel, leave namespace blank, choose OIDC, set mount
 path `netkingdom`, and use role `platform-admin`; root-token browser use is
diff --git a/sso-mfa/k8s/keycape/configure-openbao-oidc.sh b/sso-mfa/k8s/keycape/configure-openbao-oidc.sh
index a04a103..4a4b4be 100644
--- a/sso-mfa/k8s/keycape/configure-openbao-oidc.sh
+++ b/sso-mfa/k8s/keycape/configure-openbao-oidc.sh
@@ -29,34 +29,11 @@ OPENBAO_POD="${OPENBAO_POD:-openbao-0}"
   # KeyCape supports confidential downstream clients.
   OPENBAO_OIDC_MOUNTS="netkingdom keycape"
 
-  # Keep array-valued groups in groups_claim/bound_claims only. OpenBao
-  # claim_mappings copy scalar claim values into metadata and will fail if the
-  # groups array is mapped there.
-  cat >/tmp/openbao-platform-admin-role.json <<'"'"'ROLE_JSON'"'"'
-{
-  "role_type": "oidc",
-  "user_claim": "sub",
-  "groups_claim": "groups",
-  "oidc_scopes": ["openid", "profile", "email", "groups"],
-  "allowed_redirect_uris": [
-    "http://localhost:8250/oidc/callback",
-    "http://127.0.0.1:8250/oidc/callback",
-    "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
-    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
-    "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
-  ],
-  "bound_claims": {
-    "groups": ["net-kingdom-admins"]
-  },
-  "claim_mappings": {
-    "email": "email",
-    "preferred_username": "username"
-  },
-  "policies": ["platform-admin"],
-  "ttl": "1h"
-}
-ROLE_JSON
-
+  # The platform-admin role (policies, callbacks, bound claims) is owned and
+  # declared by railiance-platform at
+  # openbao/auth/netkingdom-platform-admin-role.json. This script never writes
+  # the role: it configures the OIDC mount and requires the declared role to
+  # exist. Additional allowances belong in that central declaration.
   for mount in $OPENBAO_OIDC_MOUNTS; do
     bao auth enable -path="$mount" oidc >/tmp/openbao-${mount}-auth-enable.out 2>/tmp/openbao-${mount}-auth-enable.err || {
       if grep -q "path is already in use" /tmp/openbao-${mount}-auth-enable.err; then
@@ -73,11 +50,14 @@ ROLE_JSON
       oidc_client_secret="keycape-public-pkce-compatibility-value" \
       default_role="platform-admin"
 
-    bao write "auth/${mount}/role/platform-admin" @/tmp/openbao-platform-admin-role.json
+    if ! bao read "auth/${mount}/role/platform-admin" >/dev/null 2>&1; then
+      printf "auth/%s/role/platform-admin is missing; apply the railiance-platform declaration (openbao/auth/netkingdom-platform-admin-role.json)\n" "$mount" >&2
+      exit 1
+    fi
     bao write "sys/auth/${mount}/tune" listing_visibility=unauth
-    printf "configured auth/%s/role/platform-admin and listing_visibility=unauth\n" "$mount" >&2
+    printf "configured auth/%s (role preserved) and listing_visibility=unauth\n" "$mount" >&2
   done
 
-  rm -f /tmp/openbao-platform-admin-role.json /tmp/openbao-*-auth-enable.out /tmp/openbao-*-auth-enable.err
+  rm -f /tmp/openbao-*-auth-enable.out /tmp/openbao-*-auth-enable.err
   unset BAO_TOKEN
 '