diff --git a/tools/service-identity/declarations/keycape.yaml b/tools/service-identity/declarations/keycape.yaml
index c363daa..2869312 100644
--- a/tools/service-identity/declarations/keycape.yaml
+++ b/tools/service-identity/declarations/keycape.yaml
@@ -65,7 +65,8 @@ identities:
     purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135; approval:read prepared in key-cape 82b471f (founder decision 2026-11-01, informed-decision present_existing), live only after the attended registry change"}
+      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135"}
+      - {mode: USE, scope: "approval-engine: approval:read", activation: STANDING, environments: [PRODUCTION], note: "key-cape 82b471f; live 2026-11-01 (founder-run keycape-client.py remove-then-add, sso/keycape-config rv 83590099, acceptance hub decision 21a557a9, CCR-2026-0026/0027 amendment); for informed-decision present_existing intake"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]