diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
index 140a395..74e10fc 100644
--- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
+++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
@@ -258,9 +258,10 @@ handed at
 OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1).
 Positive S3 list/get and prefix put/get/delete succeeded. Negative:
 bogus secret denied; IAM/billing/k8s list denied. Distinct from the
-bootstrap key. Not done: OpenBao policy apply (this token 403), ESO
-Secret `platform-pg-backup-s3` (absent on railiance01), bucket policy
-(no `APPLICATION_ID`). WAL still off.
+bootstrap key. Bucket policy applied 2026-08-14: prefix `platform-pg/` write ok,
+sibling prefix `AccessDenied`. Not done: OpenBao policy apply (this
+token 403), ESO Secret `platform-pg-backup-s3` (absent on
+railiance01). WAL still off.
 
 ## T05 — Prove backup, full restore, and PITR