From d24484518574504615f2bd44137c60cb97707943 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 14 Sep 2026 14:26:28 -0400
Subject: [PATCH] fix(iam): keep paychex boundary description unchanged
 (PLAT-195)

IAM managed-policy Description is immutable. Changing it on a named
policy forces replacement and 409s against the live ManagedPolicyName.
Widen PolicyDocument only.
---
 lib/deploy-substrate/deploy-substrate.template.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/deploy-substrate/deploy-substrate.template.yaml b/lib/deploy-substrate/deploy-substrate.template.yaml
index 56f095b..4bd811d 100644
--- a/lib/deploy-substrate/deploy-substrate.template.yaml
+++ b/lib/deploy-substrate/deploy-substrate.template.yaml
@@ -853,8 +853,8 @@ Resources:
     Properties:
       ManagedPolicyName: seahaven-lambda-execution-boundary-paychex-integrations
       Description: >-
-        Per-workload permissions boundary for paychex-integrations (PLAT-120,
-        PLAT-195). Floor plus minted secret ARNs and processor data plane.
+        Per-workload permissions boundary for paychex-integrations (PLAT-120).
+        Floor only until first HCP apply mints secret suffixes.
       PolicyDocument:
         Version: "2012-10-17"
         Statement: