diff --git a/infospace/interfaces/concept-placement.md b/infospace/interfaces/concept-placement.md
index 1b79721..30b0600 100644
--- a/infospace/interfaces/concept-placement.md
+++ b/infospace/interfaces/concept-placement.md
@@ -135,6 +135,11 @@ No concept is contested and no semantic disposition changes.
   word, two live InfoTechCanon senses: a right held by an actor (ITC-ORG 10.17)
   and an external body compelling disclosure (CARING 10.7). Disambiguation is
   InfoTechCanon-internal and is not made here.
-- **R-2 — CARING section 32 generalisation.** Referenced by SecurityCanon,
-  explicitly not accepted by the InfoTechCanon-side boundary review. It remains
-  an InfoTechCanon proposal requiring its own review.
+- **R-2 — resolved 2026-09-20 in InfoTechCanon (INFO-DEC-2026-001).** The
+  section 32 role set now applies wherever a subject's access is exercised
+  through another party, not to non-human subjects only. Option B from the
+  implications note was accepted narrowly: section 32.1 stays agent-stated, no
+  role is renamed, and CARING moves to canon version 0.4.0-RC2-itc2. Additive
+  and non-breaking; no SecurityCanon declaration changes. The blank cell in the
+  mapping table stands — InfoTechCanon's access-control model still has no
+  on-behalf-of relation.
diff --git a/infospace/mappings/mode-of-authority-to-infotechcanon.md b/infospace/mappings/mode-of-authority-to-infotechcanon.md
index ce20d3c..24c522c 100644
--- a/infospace/mappings/mode-of-authority-to-infotechcanon.md
+++ b/infospace/mappings/mode-of-authority-to-infotechcanon.md
@@ -112,9 +112,11 @@ either.
 
 ## 6. Open
 
-- Whether CARING generalises its §32 role set beyond non-human subjects. Additive
-  and non-breaking if adopted, but it is InfoTechCanon's to accept — raise as a
-  demand signal there, not as a change here. Analysis in the
+- ~~Whether CARING generalises its §32 role set beyond non-human subjects.~~
+  **Closed 2026-09-20.** InfoTechCanon accepted option B as INFO-DEC-2026-001:
+  the role set now applies wherever access is exercised through another party,
+  CARING is at canon version 0.4.0-RC2-itc2, and the change is additive. The
+  mapping below is unaffected. Analysis in the
   [implications note](../../docs/260920-actor-subject-implications.md) §4.
 - Whether `AuthMode` becomes a machine-readable authorization attribute
   consumable by CARING descriptors (v0.1 draft Q7).