diff --git a/openbao/policies/agent-high-risk-boundary.hcl b/openbao/policies/agent-high-risk-boundary.hcl
index 6f9775e..42251e7 100644
--- a/openbao/policies/agent-high-risk-boundary.hcl
+++ b/openbao/policies/agent-high-risk-boundary.hcl
@@ -153,3 +153,9 @@ path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" {
 path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" { capabilities = ["deny"] }
 path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" { capabilities = ["deny"] }
 path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" { capabilities = ["deny"] }
+
+# NK-WP-0049 / CCR-2026-0048 and0049: owner-only backup publisher/retention.
+path "platform/data/workloads/net-kingdom/identity-backup/publisher" { capabilities = ["deny"] }
+path "platform/metadata/workloads/net-kingdom/identity-backup/publisher" { capabilities = ["deny"] }
+path "platform/data/workloads/net-kingdom/identity-backup/retention" { capabilities = ["deny"] }
+path "platform/metadata/workloads/net-kingdom/identity-backup/retention" { capabilities = ["deny"] }