diff --git a/docs/mfa-pilot-decision.md b/docs/mfa-pilot-decision.md
new file mode 100644
index 0000000..1ee8d41
--- /dev/null
+++ b/docs/mfa-pilot-decision.md
@@ -0,0 +1,37 @@
+# MFA pilot: coulomb-social, optional, NetKingdom-held — 2026-10-09
+
+Founder decision (Bernd, 2026-10-09). It answers the pilot and policy part of
+NK-WP-0042-T02 (hub thread 892fd489). It does not resolve decision cef97ccd: user-perspective acceptance of the MFA journey still
+needs the attended run (USER-WP-0027-T04, USER-WP-0028-T03).
+
+## Decision
+
+1. **Pilot workload:** coulomb-social.
+2. **MFA code stays in NetKingdom infrastructure.** Enrollment, verification,
+   replacement, recovery, and the policy that requires MFA live with the issuer
+   (KeyCape / Keycloak, the provider factor) and user-engine (`/security`, the
+   provider-management handoff, P04 recovery, P06 policy). coulomb-social does
+   not gain factor, enrollment, recovery, or MFA policy code. It stays a plain
+   OIDC relying party.
+3. **MFA is optional for coulomb-social users.** Password-only sign-in stays
+   valid (U05). Users may enroll voluntarily through the NetKingdom path (U06).
+   Once a user has enrolled, the issuer enforces their factor (U07).
+4. **Admin-required MFA is deferred, not urgent.** When a coulomb-social admin
+   later wants MFA required for users, it will be an issuer-side client policy
+   applied through the NetKingdom admin surface (P06 preview/apply/rollback). It
+   will not be a coulomb-social code path. Turning it on is a separate change that
+   needs the founder's go.
+
+## Consequences
+
+- No `acr_values=aal2` switch-on for coulomb-social now. Under optional MFA,
+  coulomb-social requests no assurance level.
+- coulomb-social already contains a dormant relying-party hook
+  (`?assurance=aal2` → `acr_values`, plus a local acr check in
+  `apps/identity/views.py`). Nothing links to it. Whether to keep it dormant or
+  remove it is coulomb-social's call. The issuer-side policy route in (4) does
+  not need it.
+- coulomb-social may link users to the NetKingdom `/security` page for
+  optional enrollment and recovery help. That link is navigation, not MFA logic.
+- This narrows the SCOPE line "action step-up — consuming apps": for this
+  pilot, step-up sits with KeyCape client policy.
diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md
index 6334a79..7f27244 100644
--- a/workplans/USER-WP-0028-user-journey-acceptance.md
+++ b/workplans/USER-WP-0028-user-journey-acceptance.md
@@ -77,3 +77,10 @@ portal setup handoff, not another service token. See USER-WP-0027-T04 and
 `docs/evidence/2026-09-13-p06-authentication-policy.md`.
 
 2026-10-03: human gate routed to hub decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb (D10: Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience) by CUST-WP-0075; resolving that decision raises C-40 here.
+
+2026-10-09: founder chose coulomb-social as the MFA pilot (docs/mfa-pilot-decision.md).
+MFA stays optional there, and all MFA code stays in NetKingdom infrastructure:
+the issuer plus user-engine. Admin-required MFA is deferred and would be an
+issuer-side client policy. The attended run accepts U05-U08 for a coulomb-social user:
+optional enrollment, then return, then lost-factor recovery. cef97ccd stays open for
+that acceptance.