diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index e4ddeec..036b0a5 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -311,11 +311,11 @@
 | task | NK-WP-0054-T01 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T02 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T03 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
-| task | NK-WP-0054-T03b | done | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T04 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T05 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T06 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
 | task | NK-WP-0054-T07 | todo | — | workplans/NK-WP-0054-service-identity-policy.md |
+| task | NK-WP-0054-T08 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |
diff --git a/canon/standards/service-identity-privilege_v0.1.md b/canon/standards/service-identity-privilege_v0.1.md
index bb67aab..8b2c661 100644
--- a/canon/standards/service-identity-privilege_v0.1.md
+++ b/canon/standards/service-identity-privilege_v0.1.md
@@ -47,7 +47,7 @@ produced.
   citation errors (§4, §8), now corrected; railiance-platform prepared the F-1 and `aal2` role changes (source only);
   key-cape, glas-harness and state-hub assessed the agent-identity and attribution gaps (§10). No decision changed.
 
-The offline validator (`tools/service-identity`) implements draft-3 (principal type and grants, NK-WP-0054-T03b).
+The offline validator (`tools/service-identity`) implements draft-3 (principal type and grants, NK-WP-0054-T08).
 The live health check (T04) does not exist yet.
 
 ## 1. Purpose, scope and authority
diff --git a/history/2026-10-24-security-identity-and-agent-review.md b/history/2026-10-24-security-identity-and-agent-review.md
index f5b7fb6..155daa0 100644
--- a/history/2026-10-24-security-identity-and-agent-review.md
+++ b/history/2026-10-24-security-identity-and-agent-review.md
@@ -62,7 +62,7 @@ roster template, and `docs/crisis-custody-list.md` now lists custody items. They
 
 | Item | Owner |
 | --- | --- |
-| Migrate declarations and validator to grants (NK-WP-0054-T03b) | net-kingdom |
+| Migrate declarations and validator to grants (NK-WP-0054-T08) | net-kingdom |
 | Authenticate State Hub authorship for agents (actor, session) to meet SI-15 | state-hub |
 | Per-run agent identity (DSM-AGENT-002), for example short-lived agent tokens from KeyCape | key-cape, glas-harness |
 | Coding-agent role presents as `agent` (F-1) | railiance-platform |
diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md
index 5ad4eed..b214741 100644
--- a/workplans/NK-WP-0054-service-identity-policy.md
+++ b/workplans/NK-WP-0054-service-identity-policy.md
@@ -106,7 +106,7 @@ set the status to accepted when the founder decides.
 
 Draft-3 (2026-10-24): realigned as an estate profile of SecurityCanon after a review against the canon
 (`history/2026-10-24-security-identity-and-agent-review.md`): imported vocabulary, SEC-DSM references per rule,
-estate identities in canon terms, new SI-15 (accountable automation). Validator migration is T03b.
+estate identities in canon terms, new SI-15 (accountable automation). Validator migration is T08.
 Draft-2 (2026-10-24, after the founder's review): decisions applied are OpenBao `platform-admin` binds
 `aal2`; the human administrator keeps directory admin rights through an admin group; declarations start here
 and move to the services; agents get their own class and rule SI-14. Rehearsals still to do (not decisions):
@@ -152,7 +152,7 @@ SI-10 and SI-13 are not decidable from a declaration.
 ## Migrate declarations and validator to canon grants (draft-3)
 
 ```task
-id: NK-WP-0054-T03b
+id: NK-WP-0054-T08
 status: done
 priority: medium
 assignee: claude-code