diff --git a/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json b/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json
new file mode 100644
index 00000000..f9525b84
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json
@@ -0,0 +1,23 @@
+{
+  "workplan": "CUST-WP-0081",
+  "user_disposition": "Arrange scoped owner access",
+  "status": "Awaiting owner provisioning; user preference is not evidence of provisioned access",
+  "owner_repo": "railiance-platform",
+  "write_access": {
+    "route": "reuse-surface-hub-write-token",
+    "kv_path": "platform/workloads/reuse/reuse-surface/runtime-secrets",
+    "field": "REUSE_SURFACE_TOKEN",
+    "existing_read_policy": "workload-kv-read-reuse-surface-runtime",
+    "request": "Owner to admit the caller through the existing scoped route and verify its metadata lookup and selected-field read. Retain existing denial evidence; do not grant administrative or unrelated workload access.",
+    "delivery": "warden access --exec, without exporting or recording the value"
+  },
+  "private_source_access": {
+    "repositories": ["rapp-openbao", "rapp-policy-nexus", "rapp-postgres", "rapp-sbom-nexus", "rapp-telemetry", "rapp-tenant-engine", "rapp-user-engine"],
+    "request": "Owner to provision a repository-read credential at the federation hub, confirm source-owner consent to public capability metadata, and verify hub-side index and entry fetches.",
+    "return_only": ["configured auth_env name", "auth_header name if nondefault", "scope and verification receipts"],
+    "visibility_change_authorized": false
+  },
+  "resume": "Update and retain the exact registration proposal revision with admitted auth_env references, verify source parity, execute bounded registrations, then require all 70 reviewed IDs exactly once in a fresh hosted federation.",
+  "secret_values_requested_in_chat": false,
+  "owner_message_sent": false
+}
diff --git a/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
index dc739a4c..a1174fc2 100644
--- a/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
+++ b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
@@ -52,7 +52,7 @@ registries and compose a deterministic federation with no missing reviewed IDs.
 Verify publication and hosted discovery separately; local establishment alone
 does not prove hosted federation. Preserve unrelated worktree changes.
 
-2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User asked to arrange scoped access or leave hosted establishment pending; no answer recorded. Exact plan, denial and verification evidence are in the assessment directory.
+2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User selected "Arrange scoped owner access"; provisioning remains unverified. The scoped-access-handoff.json records the exact owner requirements without secret values. Exact plan, denial and verification evidence are in the assessment directory.
 
 ## Audit coverage and record the result