diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
index ff721f5..465ee30 100644
--- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
+++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
@@ -82,3 +82,8 @@ After platform applies the objects: a live metadata-only survey and the
 plan's six verification checks (capabilities and metadata only). Then a
 pointer-only ops-warden entry for the operator lane (`resolvable: false`
 until the checks pass).
+
+Note (2026-10-07, MASON-IN-0004): the capability verification runs under the
+read-only `ops-mason-survey` grant, which replaces `ops-mason-build`. Installing
+that policy is a founder act (AGENTS.md, "Installing the survey policy");
+ops-mason cannot install or widen it.