diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
new file mode 100644
index 0000000..79e2c10
--- /dev/null
+++ b/terraform/hcp_iam.tf
@@ -0,0 +1,430 @@
+# HCP plan/apply roles imported from seahaven-terraform-substrate (PLAT-146).
+# Import, do not recreate. Role names stay hcptf-afi-backup-monitor /
+# hcptf-afi-backup-monitor-plan.
+#
+# Live seahaven-hcptf-iam-management DenySelfMutation blocks DetachRolePolicy
+# and PutRolePolicy on hcptf-* (including this role). Import apply sequence:
+#   1. seahaven-org-baseline scripts/create-hcptf-bootstrap-roles.sh
+#        --account prod --allow-workspace afi-backup-monitor-prod
+#   2. Point this workspace's TFC_AWS_* at hcptf-bootstrap /
+#      hcptf-bootstrap-plan (workspace vars, never a project set).
+#   3. One Manual apply (import + detach seahaven-hcptf-iam-management +
+#      put scoped inline).
+#   4. Point TFC_AWS_* back at hcptf-afi-backup-monitor /
+#      hcptf-afi-backup-monitor-plan.
+#   5. Re-run the script without --allow-workspace to pin trust back to
+#      iam-bootstrap-prod only.
+# Lambda permissions_boundary remains
+# seahaven-lambda-execution-boundary-afi-backup-monitor.
+
+import {
+  to = aws_iam_role.hcptf_apply
+  id = "hcptf-afi-backup-monitor"
+}
+
+import {
+  to = aws_iam_role.hcptf_plan
+  id = "hcptf-afi-backup-monitor-plan"
+}
+
+import {
+  to = aws_iam_role_policy.hcptf_apply_services
+  id = "hcptf-afi-backup-monitor:afi-backup-monitor-services"
+}
+
+import {
+  to = aws_iam_role_policy.hcptf_plan_refresh
+  id = "hcptf-afi-backup-monitor-plan:afi-backup-monitor-plan-refresh"
+}
+
+import {
+  to = aws_iam_role_policy_attachments_exclusive.hcptf_apply
+  id = "hcptf-afi-backup-monitor"
+}
+
+import {
+  to = aws_iam_role_policy_attachment.hcptf_plan_viewonly
+  id = "hcptf-afi-backup-monitor-plan/arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
+}
+
+import {
+  to = aws_iam_role_policy_attachments_exclusive.hcptf_plan
+  id = "hcptf-afi-backup-monitor-plan"
+}
+
+data "aws_iam_policy_document" "hcptf_apply_trust" {
+  statement {
+    sid     = "HcpApply"
+    effect  = "Allow"
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type        = "Federated"
+      identifiers = ["arn:aws:iam::${local.account_id}:oidc-provider/app.terraform.io"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "app.terraform.io:aud"
+      values   = ["aws.workload.identity"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "app.terraform.io:sub"
+      values = [
+        "organization:seahaven:project:seahaven-prod:workspace:afi-backup-monitor-prod:run_phase:apply",
+      ]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "hcptf_plan_trust" {
+  statement {
+    sid     = "HcpPlan"
+    effect  = "Allow"
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type        = "Federated"
+      identifiers = ["arn:aws:iam::${local.account_id}:oidc-provider/app.terraform.io"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "app.terraform.io:aud"
+      values   = ["aws.workload.identity"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "app.terraform.io:sub"
+      values = [
+        "organization:seahaven:project:seahaven-prod:workspace:afi-backup-monitor-prod:run_phase:plan",
+      ]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "hcptf_scoped_iam" {
+  statement {
+    sid       = "DenyCreatePolicy"
+    effect    = "Deny"
+    actions   = ["iam:CreatePolicy", "iam:CreatePolicyVersion"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid       = "CreateExecRoleWithBoundary"
+    effect    = "Allow"
+    actions   = ["iam:CreateRole"]
+    resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/afi-*"]
+
+    condition {
+      test     = "StringLike"
+      variable = "iam:PermissionsBoundary"
+      values = [
+        "arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*",
+        "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor",
+      ]
+    }
+  }
+
+  statement {
+    sid    = "MutateExecRoleWithBoundary"
+    effect = "Allow"
+    actions = [
+      "iam:AttachRolePolicy",
+      "iam:PutRolePolicy",
+      "iam:PutRolePermissionsBoundary",
+    ]
+    resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/afi-*"]
+
+    condition {
+      test     = "StringLike"
+      variable = "iam:PermissionsBoundary"
+      values = [
+        "arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*",
+        "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor",
+      ]
+    }
+  }
+
+  statement {
+    sid    = "WriteExecRoles"
+    effect = "Allow"
+    actions = [
+      "iam:DeleteRole",
+      "iam:DeleteRolePolicy",
+      "iam:DetachRolePolicy",
+      "iam:TagRole",
+      "iam:UntagRole",
+      "iam:UpdateAssumeRolePolicy",
+      "iam:UpdateRole",
+      "iam:UpdateRoleDescription",
+    ]
+    resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/afi-*"]
+  }
+
+  statement {
+    sid       = "PassExecRolesToLambda"
+    effect    = "Allow"
+    actions   = ["iam:PassRole"]
+    resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/afi-*"]
+
+    condition {
+      test     = "StringEquals"
+      variable = "iam:PassedToService"
+      values   = ["lambda.amazonaws.com"]
+    }
+  }
+
+  statement {
+    sid    = "IamReadOnly"
+    effect = "Allow"
+    actions = [
+      "iam:GetPolicy",
+      "iam:GetPolicyVersion",
+      "iam:GetRole",
+      "iam:GetRolePolicy",
+      "iam:ListAttachedRolePolicies",
+      "iam:ListPolicies",
+      "iam:ListPolicyVersions",
+      "iam:ListRolePolicies",
+      "iam:ListRoles",
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "DenySelfMutation"
+    effect = "Deny"
+    actions = [
+      "iam:AttachRolePolicy",
+      "iam:DeleteRole",
+      "iam:DeleteRolePolicy",
+      "iam:DeleteRolePermissionsBoundary",
+      "iam:DetachRolePolicy",
+      "iam:PutRolePolicy",
+      "iam:PutRolePermissionsBoundary",
+      "iam:UpdateAssumeRolePolicy",
+      "iam:UpdateRole",
+      "iam:UpdateRoleDescription",
+    ]
+    resources = [
+      "arn:aws:iam::${local.account_id}:role/hcptf-*",
+      "arn:aws:iam::${local.account_id}:role/github-cfn-execution-role",
+      "arn:aws:iam::${local.account_id}:role/githubdeploy-*",
+      "arn:aws:iam::${local.account_id}:role/cdk-hnb659fds-*",
+      "arn:aws:iam::${local.account_id}:role/OrganizationAccountAccessRole",
+      "arn:aws:iam::${local.account_id}:role/seahaven-*",
+    ]
+  }
+
+  statement {
+    sid    = "DenyBoundaryTampering"
+    effect = "Deny"
+    actions = [
+      "iam:DeleteRolePermissionsBoundary",
+      "iam:DeleteUserPermissionsBoundary",
+    ]
+    resources = [
+      "arn:aws:iam::${local.account_id}:role/*",
+      "arn:aws:iam::${local.account_id}:user/*",
+    ]
+  }
+
+  statement {
+    sid    = "DenyBoundaryPolicyEdit"
+    effect = "Deny"
+    actions = [
+      "iam:CreatePolicyVersion",
+      "iam:DeletePolicy",
+      "iam:DeletePolicyVersion",
+      "iam:SetDefaultPolicyVersion",
+    ]
+    resources = ["arn:aws:iam::${local.account_id}:policy/seahaven-*"]
+  }
+}
+
+data "aws_iam_policy_document" "hcptf_apply_services" {
+  statement {
+    sid     = "LambdaAll"
+    effect  = "Allow"
+    actions = ["lambda:*"]
+    resources = [
+      "arn:aws:lambda:us-east-1:${local.account_id}:function:afi-*",
+      "arn:aws:lambda:us-east-1:${local.account_id}:layer:afi-shared*",
+    ]
+  }
+
+  statement {
+    sid       = "LambdaList"
+    effect    = "Allow"
+    actions   = ["lambda:ListFunctions", "lambda:ListLayers", "lambda:GetAccountSettings"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid       = "EventBridgeRules"
+    effect    = "Allow"
+    actions   = ["events:*"]
+    resources = ["arn:aws:events:us-east-1:${local.account_id}:rule/afi-*"]
+  }
+
+  statement {
+    sid    = "CloudWatchLogs"
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogGroup",
+      "logs:DeleteLogGroup",
+      "logs:PutRetentionPolicy",
+      "logs:DeleteRetentionPolicy",
+      "logs:TagResource",
+      "logs:UntagResource",
+      "logs:ListTagsForResource",
+    ]
+    resources = ["arn:aws:logs:us-east-1:${local.account_id}:log-group:/aws/lambda/afi-*"]
+  }
+
+  statement {
+    sid       = "CloudWatchLogsDescribe"
+    effect    = "Allow"
+    actions   = ["logs:DescribeLogGroups"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid     = "LambdaArtifactsBucket"
+    effect  = "Allow"
+    actions = ["s3:*"]
+    resources = [
+      "arn:aws:s3:::afi-backup-monitor-artifacts-${local.account_id}",
+      "arn:aws:s3:::afi-backup-monitor-artifacts-${local.account_id}/*",
+    ]
+  }
+}
+
+data "aws_iam_policy_document" "hcptf_plan_refresh" {
+  statement {
+    sid    = "RefreshIamRoles"
+    effect = "Allow"
+    actions = [
+      "iam:GetRole",
+      "iam:GetRolePolicy",
+      "iam:ListRolePolicies",
+      "iam:ListAttachedRolePolicies",
+    ]
+    resources = [
+      "arn:aws:iam::${local.account_id}:role/tf-managed/afi-*",
+      "arn:aws:iam::${local.account_id}:role/hcptf-afi-backup-monitor",
+      "arn:aws:iam::${local.account_id}:role/hcptf-afi-backup-monitor-plan",
+    ]
+  }
+
+  statement {
+    sid       = "RefreshManagedPolicies"
+    effect    = "Allow"
+    actions   = ["iam:GetPolicy", "iam:GetPolicyVersion"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "RefreshEventBridge"
+    effect = "Allow"
+    actions = [
+      "events:DescribeRule",
+      "events:ListTargetsByRule",
+      "events:ListTagsForResource",
+    ]
+    resources = ["arn:aws:events:us-east-1:${local.account_id}:rule/afi-*"]
+  }
+
+  statement {
+    sid    = "RefreshLambda"
+    effect = "Allow"
+    # Read-only refresh for plan. Mutate APIs stay on the apply role.
+    actions = ["lambda:Get*", "lambda:List*"]
+    resources = [
+      "arn:aws:lambda:us-east-1:${local.account_id}:function:afi-*",
+      "arn:aws:lambda:us-east-1:${local.account_id}:layer:afi-shared*",
+    ]
+  }
+
+  statement {
+    sid     = "RefreshArtifactsBucket"
+    effect  = "Allow"
+    actions = ["s3:Get*", "s3:ListBucket"]
+    resources = [
+      "arn:aws:s3:::afi-backup-monitor-artifacts-${local.account_id}",
+      "arn:aws:s3:::afi-backup-monitor-artifacts-${local.account_id}/*",
+    ]
+  }
+
+  statement {
+    sid       = "RefreshLogs"
+    effect    = "Allow"
+    actions   = ["logs:DescribeLogGroups", "logs:ListTagsForResource"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role" "hcptf_apply" {
+  name                 = "hcptf-afi-backup-monitor"
+  assume_role_policy   = data.aws_iam_policy_document.hcptf_apply_trust.json
+  max_session_duration = 3600
+
+  tags = {
+    Project   = "afi-backup-monitor"
+    Owner     = "adam@seahavenind.com"
+    ManagedBy = "terraform"
+  }
+}
+
+# Empty exclusive set keeps seahaven-hcptf-iam-management detached.
+resource "aws_iam_role_policy_attachments_exclusive" "hcptf_apply" {
+  role_name   = aws_iam_role.hcptf_apply.name
+  policy_arns = []
+}
+
+resource "aws_iam_role" "hcptf_plan" {
+  name                 = "hcptf-afi-backup-monitor-plan"
+  assume_role_policy   = data.aws_iam_policy_document.hcptf_plan_trust.json
+  max_session_duration = 3600
+
+  tags = {
+    Project   = "afi-backup-monitor"
+    Owner     = "adam@seahavenind.com"
+    ManagedBy = "terraform"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "hcptf_plan_viewonly" {
+  role       = aws_iam_role.hcptf_plan.name
+  policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
+}
+
+resource "aws_iam_role_policy_attachments_exclusive" "hcptf_plan" {
+  role_name = aws_iam_role.hcptf_plan.name
+  policy_arns = [
+    aws_iam_role_policy_attachment.hcptf_plan_viewonly.policy_arn,
+  ]
+}
+
+resource "aws_iam_role_policy" "hcptf_scoped_iam" {
+  name   = "scoped-iam-management"
+  role   = aws_iam_role.hcptf_apply.id
+  policy = data.aws_iam_policy_document.hcptf_scoped_iam.json
+}
+
+resource "aws_iam_role_policy" "hcptf_apply_services" {
+  name   = "afi-backup-monitor-services"
+  role   = aws_iam_role.hcptf_apply.id
+  policy = data.aws_iam_policy_document.hcptf_apply_services.json
+}
+
+resource "aws_iam_role_policy" "hcptf_plan_refresh" {
+  name   = "afi-backup-monitor-plan-refresh"
+  role   = aws_iam_role.hcptf_plan.id
+  policy = data.aws_iam_policy_document.hcptf_plan_refresh.json
+}