diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 3b5f292..cd1cfa3 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -28,6 +28,7 @@
 | workplan | RPF-WP-0049 | finished | — | workplans/RPF-WP-0049-platform-root-custody-record-delivery.md |
 | workplan | RPF-WP-0050 | blocked | — | workplans/RPF-WP-0050-attended-provisioning-preparation.md |
 | workplan | RPF-WP-0051 | finished | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
+| workplan | RPF-WP-0052 | finished | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
 | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
@@ -116,6 +117,9 @@
 | task | RPF-WP-0051-T01 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
 | task | RPF-WP-0051-T02 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
 | task | RPF-WP-0051-T03 | done | — | workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md |
+| task | RPF-WP-0052-T01 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
+| task | RPF-WP-0052-T02 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
+| task | RPF-WP-0052-T03 | done | — | workplans/RPF-WP-0052-authelia-platform-smtp-admission.md |
 | intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
 | intake | RPF-IN-0002 | open | — | intakes/intakes.md |
 | intake | RPF-IN-0003 | open | — | intakes/intakes.md |
diff --git a/credential-change-requests/CCR-2026-0033.yaml b/credential-change-requests/CCR-2026-0033.yaml
index bc6723c..a2bb9c1 100644
--- a/credential-change-requests/CCR-2026-0033.yaml
+++ b/credential-change-requests/CCR-2026-0033.yaml
@@ -46,6 +46,12 @@ review:
       and A3 (exactly one attended custody-child provision run, cas=0, KV version
       1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
       KeyCape registration, the restart or any rotation.
+  - at: '2026-10-07'
+    reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch)
+    decision: approved
+    comment: Founder decision 1fdd993b-8899-4f87-8a8e-636346bb9692 approves the token_self_lifecycle amendment (lookup-self
+      and revoke-self on the ESO reader's own token) and one delegated re-apply of this
+      CCR's policy and role. Nothing else changes.
 target:
   domain: infotech
   tenant: platform