diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index bd3ae55..b347429 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -92,7 +92,7 @@
 | task | MASON-WP-0013-T03 | wait | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
 | task | MASON-WP-0013-T04 | wait | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
 | task | MASON-WP-0014-T01 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
-| task | MASON-WP-0014-T02 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
+| task | MASON-WP-0014-T02 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
 | task | MASON-WP-0014-T03 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
 | task | MASON-WP-0014-T04 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
 | task | MASON-WP-0015-T01 | done | — | workplans/MASON-WP-0015-construct-grant.md |
diff --git a/plans/mas-tem-relay-smtp.md b/plans/mas-tem-relay-smtp.md
index f6f8999..066d9ce 100644
--- a/plans/mas-tem-relay-smtp.md
+++ b/plans/mas-tem-relay-smtp.md
@@ -228,4 +228,26 @@ No catalog entry: the lane is temporary and has a single consumer.
 
 ## 5. Executive summary
 
-*(Generated after review.)*
+**One-line ask:** let the temporary MAS test mail server read its TEM SMTP
+login from OpenBao, and nothing else, until MAS-WP-0003 ends.
+
+**Who gets access:** the External Secrets reader in namespace `mas`, and
+only when it signs in as ServiceAccount `mas-tem-relay-eso`. No person, no
+agent, no other namespace.
+
+**To what:** read on `platform/suppliers/scaleway/mas-tem-relay`
+(`username`, `password`), delivered as Secret `mas/mas-relay` to the `mas-mx`
+container at `/etc/mas-relay`.
+
+**For how long:** 15-minute OpenBao sessions, renewed by ESO, until teardown
+at MAS-WP-0003 close. The Scaleway key's own expiry is the hard stop.
+
+**Blast radius if the credential leaks:** someone can send mail as your TEM
+project, which risks reputation, quota and cost, until you revoke the key in
+the Scaleway console. If the key is TEM-only it gives no other Scaleway
+access.
+
+**Cost to reverse:** low. Delete the role, the policy and the KV path, then
+revoke the key. Nothing else depends on it.
+
+**Decision:** pending.