Record platform-operator approval, delegated policy/OIDC role apply, negative verification evidence, and add attended PAT provision script.
