diff --git a/docs/bounded-execution-contract-table.md b/docs/bounded-execution-contract-table.md
index e2f6d73..908c8dd 100644
--- a/docs/bounded-execution-contract-table.md
+++ b/docs/bounded-execution-contract-table.md
@@ -469,3 +469,18 @@ The agent's default context can read NetworkPolicies in `sso`, `approval-engine`
   exec and kubeconfigs. The founder-only rows stay founder-only.
 - **For T07:** `portal-client-rollout.py` and three other tools hard-code kubeconfigs (`config-hosteurope`,
   `/etc/rancher/k3s/k3s.yaml`).
+
+## Routing of the owner decisions (2026-11-05)
+
+| Row | Question | Routed to | Reference |
+| --- | --- | --- | --- |
+| E5 + C7 | Approver and routing; the routing table decides who can approve | NK-WP-0057-T01 | workplan inputs |
+| E2 | Who registers KeyCape clients, with no KeyCape rapp | NK-WP-0057-T01 | workplan inputs |
+| E7 | Runtime owner of LLDAP, Authelia and KeyCape in `sso` | NK-WP-0057-T01 | workplan inputs |
+| C1 | A supported platform interface for window roles | railiance-platform | message `f6198285` |
+| O1 | Which objects on the path Argo CD owns | railiance-platform (with railiance-cluster) | message `f6198285` |
+| C5 | Correct the stale Secret name in `bounded-executor.md:85-90` | railiance-platform | message `f6198285` |
+| O2 | Strip every token variable in `warden access --exec`; name the variable in the refusal | ops-warden | message `4acb653c` |
+| C6 | Which copy of the executor's present-existing profile is the source | informed-decision and access-engine | messages `fa7e25d3`, `df5aa613` |
+| E3 | `required_assurance` | not routed: answered 2026-10-31 (`756016f9`); waits for approval-engine v7 release | — |
+| C3 | Who materializes | not routed: tracked in ops-mason MASON-WP-0010-T03 (`91e2205f`) | — |