diff --git a/terraform/iam.tf b/terraform/iam.tf
index 94139f5..3bb8f16 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -1,10 +1,10 @@
 # Execution roles for the seven Lambda functions plus the API Gateway role that
 # invokes the admin authorizer.
 #
-# Every role is created under the /tf-managed/ path and carries the account's
-# seahaven-lambda-execution-boundary permissions boundary. The path is what
-# distinguishes Terraform-owned roles from the /cfn-managed/ roles the retired
-# SAM stack created.
+# Every Lambda execution role is created under the /tf-managed/ path and
+# carries seahaven-lambda-execution-boundary-meal-order-manager (PLAT-52).
+# The path distinguishes Terraform-owned roles from the retired SAM
+# /cfn-managed/ roles.
 #
 # The inline policies below are hand-expanded from the SAM policy templates in
 # template.yaml (DynamoDBCrudPolicy, DynamoDBReadPolicy, S3CrudPolicy,
diff --git a/terraform/iam_github_weekly_menu.tf b/terraform/iam_github_weekly_menu.tf
index 21001f2..ce2b122 100644
--- a/terraform/iam_github_weekly_menu.tf
+++ b/terraform/iam_github_weekly_menu.tf
@@ -43,11 +43,13 @@ data "aws_iam_policy_document" "weekly_menu_assume" {
 }
 
 resource "aws_iam_role" "weekly_menu" {
-  name                 = "githubdeploy-meal-order-manager-weekly-menu"
-  path                 = "/tf-managed/"
-  description          = "GitHub Actions weekly-menu scrape/publish for meal-order-manager"
+  name        = "githubdeploy-meal-order-manager-weekly-menu"
+  path        = "/tf-managed/"
+  description = "GitHub Actions weekly-menu scrape/publish for meal-order-manager"
+  # Not a Lambda execution role. Do not attach seahaven-lambda-execution-boundary
+  # (PLAT-52). HCP apply cannot DeleteRolePermissionsBoundary (DenyBoundaryTampering);
+  # stripping the live attachment is an administrator action after this apply.
   assume_role_policy   = data.aws_iam_policy_document.weekly_menu_assume.json
-  permissions_boundary = local.boundary_arn
   max_session_duration = 3600
 }
 
diff --git a/terraform/locals.tf b/terraform/locals.tf
index a8d48c1..bfa22f1 100644
--- a/terraform/locals.tf
+++ b/terraform/locals.tf
@@ -2,9 +2,9 @@ locals {
   project    = "meal-order-manager"
   account_id = "011934824531"
 
-  # Every execution role in this configuration is created under /tf-managed/ and
-  # carries the account's Lambda execution boundary.
-  boundary_arn = "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary"
+  # Lambda execution roles under /tf-managed/ carry the per-workload ceiling
+  # (PLAT-52). githubdeploy-meal-order-manager-weekly-menu must not.
+  boundary_arn = "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-meal-order-manager"
 
   form_bucket_name      = "${local.project}-form-${local.account_id}"
   reports_bucket_name   = "${local.project}-reports-${local.account_id}"