diff --git a/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md b/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md
index 18d2af0..da815bc 100644
--- a/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md
+++ b/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md
@@ -306,3 +306,16 @@ credentials. Existing email recovery proves the isolated-project mechanism, not
 a grant for Coulomb. Resource-specific grants and independent kit custody still
 need native execution through an attended platform operator front door. Approval
 is recorded; implementation/verification remain T02/T03/T04.
+
+## One-time provider bootstrap, routine programmatic access — 2026-10-28
+
+User instruction recorded as decision6139e02b-3fb7-4eff-be8a-efe127c45ce5:
+the offered attended Scaleway Console login is bootstrap only; regular later
+access must use scoped APIs. Provision governed publisher, independent archive
+reader and custodian escrow API access within the already approved Coulomb
+recovery custody scope. Their credentials/kit must survive primary-node and
+workstation loss. Personal Console session state is never a scheduled worker or
+regular recovery/drill credential. Retire the temporary session after native API
+verification. No standing organization-wide operator key or publisher IAM admin
+right follows from this instruction. First aborted attempt saved no state; fresh
+attended browser is waiting for user confirmation, with no provider mutation.