diff --git a/workplans/WARDEN-WP-0044-security-case-follow-through.md b/workplans/WARDEN-WP-0044-security-case-follow-through.md
index 23e52d2..103446a 100644
--- a/workplans/WARDEN-WP-0044-security-case-follow-through.md
+++ b/workplans/WARDEN-WP-0044-security-case-follow-through.md
@@ -161,6 +161,13 @@ reverses exactly this case's steps.
 Acceptance: the Forgejo reference case (NK-WP-0048-T06) reaches `live` through
 this path, with no case-specific script.
 
+Agreed with railiance-platform (RPF-WP-0054-T01, 2026-10-09):
+- `mint-secret` runs `credential.py generate --grant keycape/client-secret-generate
+  --client-id <id> --case-ref <case-ref> --case-file <case.yaml>` as the caller's
+  child process. The broker re-derives the case-ref and checks status and
+  client_id.
+- warden refuses that step when `WARDEN_AGENT_ID` is set.
+
 ```task
 id: WARDEN-WP-0044-T04
 status: wait