diff --git a/scripts/iam/provision-rbac.py b/scripts/iam/provision-rbac.py
index 2afdd94..42f3924 100644
--- a/scripts/iam/provision-rbac.py
+++ b/scripts/iam/provision-rbac.py
@@ -133,9 +133,10 @@ SERVICE_ACCOUNTS: Dict[str, Dict[str, Any]] = {
     },
     "temporal-worker-agent": {
         "description": "Temporal workflow worker",
-        "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write"],
+        "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send"],
         "claims": {
             "memory_projects": ["*"],
+            "sqs_queues": ["*"],
             "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"],
         },
     },
@@ -290,6 +291,7 @@ OAuth2_PROVIDERS = {
     "poimen": {"client_id": "poimen", "redirect_uris": ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]},
     "paperless": {"client_id": "paperless", "redirect_uris": ["http://localhost:8000/auth/complete", "https://paperless.riotpiao.com/auth/complete"]},
     "grafana": {"client_id": "grafana", "redirect_uris": ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"]},
+    "queue": {"client_id": "queue-sqs", "redirect_uris": ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]},
 }
 
 for provider_name, provider_spec in OAuth2_PROVIDERS.items():