README.md

@@ -66,13 +66,17 @@ EventBridge (daily 02:00 UTC)
 | Conversation Log | DynamoDB `seahaven-conversations` (90-day TTL) |
 | Unanswered Questions | DynamoDB `seahaven-unanswered-questions` (180-day TTL) |
 | Payment Data | DynamoDB `PaymentsDashboard` (via payments-dashboard) |
-| PO Data Source | DynamoDB `purchase-orders` (via po-ingest) |
+| PO Data Source | DynamoDB `purchase-orders` (read-only; owned by procurement-ingest / po-ingest) |
 | Work Order Data Source | DynamoDB `WorkOrders` + `WorkOrderComments` (via workorder-ingest) |
 | Site Assignments | DynamoDB `verified-sites` (auto-populated via po-ingest Streams pipeline) |
 | VPC | `seahaven-vpc` (`vpc-0d3d4b67bd0cf8a68`) — QBO Lambdas + Socket Mode |
 | Static Outbound IP | `52.202.83.13` (NAT Gateway for Intuit IP allowlist) |
 | QBO OAuth URLs | `bot.seahaven.com/qbo/connect`, `/qbo/callback`, `/qbo/disconnect`, `/qbo/launch` |
 
+### Shared Resources
+
+This bot reads the `purchase-orders` DynamoDB table **read-only** (via the `po-sync` and `wo-po-lookup` Lambdas, both granted `grantReadData`). The table is owned by the `procurement-ingest` repo (`po-ingest` stack), which is the sole authoritative writer. Any change to the `purchase-orders` schema must be coordinated with `procurement-ingest` (owner) and `payments-dashboard` (the other read-only consumer).
+
 ## Prerequisites
 
 - Node.js 22+