diff --git a/workplans/MASON-WP-0015-construct-grant.md b/workplans/MASON-WP-0015-construct-grant.md
index 26331ea..9bb60ec 100644
--- a/workplans/MASON-WP-0015-construct-grant.md
+++ b/workplans/MASON-WP-0015-construct-grant.md
@@ -118,3 +118,21 @@ applies with cannot `create serviceaccounts/token` or Pods in namespaces it
 binds roles to (`kubectl auth can-i`). `kubernetes_plane` already refuses
 the Pod and Secret kinds. Record the result in INTENT.md's
 `kubernetes-plane-apply` entry.
+
+## Submit CCRs from approved plans (RPF-WP-0061)
+
+```task
+id: MASON-WP-0015-T07
+status: wait
+priority: medium
+```
+
+railiance-platform RPF-WP-0061 makes ops-mason the only CCR submitter
+(`credential-change.py submit`). ops-mason's side:
+- generate the CCR draft and policy file from the plan, using platform's
+  generator once it is exposed;
+- take plan approval from the single hub decision after `sync-decision`;
+- compare the built policy with the CCR policy file, then `record-evidence`.
+
+Comment sent 2026-10-18, as a reply to `f49ddd0d`. This waits on
+RPF-WP-0061-T03 and T04.