diff --git a/SCOPE.md b/SCOPE.md
index f15b0d6..f672cb5 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -95,6 +95,13 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope.
   This is a package evidence reference, not a fresh live health observation.
 - k3s API access is tunnel-only on Railiance01; see `railiance-infra`
   `RAIL-HO-WP-0009` and ADR-005. It is not a public/source-allowlisted surface.
+- Admin credential file modes (RCLUSTER-WP-0019, done 2026-10-20): the
+  installer writes the admin kubeconfig with mode 600 and no longer exports it.
+  `ansible/k3s-kubeconfig-mode.yml`, applied on railiance01, keeps
+  the admin kubeconfig and `registries.yaml` at root 0600.
+  `registries.yaml`, which holds a registry login, had been found at 0644.
+  Restricted agent accounts on the node therefore cannot read cluster-admin or
+  registry credentials.
 
 ---
 
@@ -133,7 +140,7 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope.
 ```capability
 type: infrastructure
 title: Kubernetes cluster provisioning (k3s)
-description: Install and configure a production k3s cluster including Helm, Traefik ingress, networking, and kubeconfig management on Railiance servers.
+description: Install and configure a production k3s cluster including Helm, Traefik ingress, networking, and kubeconfig management on Railiance servers. Admin kubeconfig and registries.yaml are kept root 0600 (ansible/k3s-kubeconfig-mode.yml); the installer does not export the admin kubeconfig.
 keywords: [kubernetes, k3s, cluster, helm, ingress, cni, k8s, provisioning]
 ```