diff --git a/docs/workload-kv-access-lanes.md b/docs/workload-kv-access-lanes.md
index 617df71..ff8094c 100644
--- a/docs/workload-kv-access-lanes.md
+++ b/docs/workload-kv-access-lanes.md
@@ -396,3 +396,43 @@ warden access binky-company-email-imap --all --out /tmp/p          # preferred
 ```
 
 Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.
+
+## agent-harness Forgejo deploy key
+
+| Item | Value |
+| --- | --- |
+| ops-warden catalog id | `agent-harness-forgejo-deploy` |
+| OpenBao CLI path | `platform/workloads/agent-harness/forgejo-deploy-key` |
+| Fields | `SSH_PRIVATE_KEY`, `SSH_PUBLIC_KEY` |
+| Read policy | `workload-kv-read-agent-harness-forgejo` |
+| Policy file | `openbao/policies/workload-kv-read-agent-harness-forgejo.hcl` |
+| Worker host | railiance01 `~/.local/agent-harness/ssh/forgejo-deploy` |
+| Deploy key repos | `coulomb/executor-sandbox` (write); `binky-control` at cutover |
+| Front-door readiness | active (provisioned 2026-07-17) |
+| Risk | high |
+
+```bash
+# public key only is safe to print; never print SSH_PRIVATE_KEY
+bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key
+```
+
+## agent-harness Binky mail AppRole
+
+| Item | Value |
+| --- | --- |
+| ops-warden catalog id | `agent-harness-binky-mail-approle` |
+| AppRole name | `agent-harness-binky-mail` |
+| Token policies | `workload-kv-read-binky-company-email-imap` |
+| token_ttl / max | 15m / 30m |
+| token_num_uses | 8 |
+| Host delivery | railiance01 `~/.local/agent-harness/approle-binky-mail/{role_id,secret_id}` |
+| Env | `EXECUTOR_APPROLE_DIR` via `~/.local/agent-harness/env` |
+| Front-door readiness | active (provisioned 2026-07-17) |
+| Risk | high |
+
+Does **not** replace the human OIDC role
+`binky-company-email-imap-workload-kv-read`. Same secret path; separate
+unattended principal.
+
+Playbook: `ops-warden/wiki/playbooks/agent-harness-secrets.md`.
+
diff --git a/openbao/policies/workload-kv-read-agent-harness-forgejo.hcl b/openbao/policies/workload-kv-read-agent-harness-forgejo.hcl
new file mode 100644
index 0000000..f76b64f
--- /dev/null
+++ b/openbao/policies/workload-kv-read-agent-harness-forgejo.hcl
@@ -0,0 +1,11 @@
+# Least-privilege read policy for agent-harness Forgejo deploy key.
+# Private key is held on the worker host; OpenBao holds a recovery/copy.
+# Exact path only — no list on parent, no sibling workload paths.
+
+path "platform/data/workloads/agent-harness/forgejo-deploy-key" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/agent-harness/forgejo-deploy-key" {
+  capabilities = ["read"]
+}