diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 07d7174..c0c082b 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -120,4 +120,4 @@
 | task | WARDEN-WP-0032-T03 | wait | — | workplans/WARDEN-WP-0032-security-zones.md |
 | task | WARDEN-WP-0032-T04 | wait | — | workplans/WARDEN-WP-0032-security-zones.md |
 | task | WARDEN-WP-0032-T05 | done | — | workplans/WARDEN-WP-0032-security-zones.md |
-| task | WARDEN-WP-0032-T06 | wait | — | workplans/WARDEN-WP-0032-security-zones.md |
+| task | WARDEN-WP-0032-T06 | progress | — | workplans/WARDEN-WP-0032-security-zones.md |
diff --git a/workplans/WARDEN-WP-0032-security-zones.md b/workplans/WARDEN-WP-0032-security-zones.md
index 1e4a836..10e5bfc 100644
--- a/workplans/WARDEN-WP-0032-security-zones.md
+++ b/workplans/WARDEN-WP-0032-security-zones.md
@@ -256,9 +256,30 @@ ungraded lane being committed. Four regression tests cover it.
 maturity-derived default: an experimental-context lane may be explicitly
 accepted, which is a graded decision rather than an omission.
 
-**Still open on this task:** whether the maturity-derived default replaces the
-`ungraded` sentinel entirely (waits on `ZONE-WP-0001-T03`), and verifying
-OpenBao's `agent-high-risk-boundary` policy covers these paths.
+**Second layer checked 2026-08-20 — it does not cover them.** The OpenBao side
+was compared statically (policy file vs catalog): `agent-high-risk-boundary`
+denies 5 data paths covering **6** of the **17** high-risk lanes. Eight
+high-risk lanes with concrete KV paths are not denied — and **four of those were
+already graded `high` before the regrade**, so the divergence is pre-existing
+rather than something the grading introduced. It had simply never been
+comparable before.
+
+This matters more than the ops-warden half: `warden access` exits 7 for all 17,
+but that only protects the ops-warden path. The OpenBao policy is what protects a
+direct `bao kv get`, which is the actual 2026-07-16 vector.
+
+Routed to `risk-nexus` as **`RISK-F-0004`**, `fix_owner: railiance-platform` —
+the policy is theirs, and ops-warden does not amend another repo's control.
+
+**Live confirmation still outstanding.** ops-warden's OpenBao token is expired
+(`bao token lookup` → 403), so `bao policy read` and `bao token capabilities`
+could not be run and the deployed policy may differ from the file. A
+capabilities-only verification script is ready and needs an operator
+`bao login -method=oidc` to run; it is deliberately capabilities-only, never a
+read.
+
+**Still open:** whether the maturity-derived default replaces the `ungraded`
+sentinel entirely (waits on `ZONE-WP-0001-T03`).
 
 ## Related