- Added queue OAuth2 provider (pk=13, client_id=queue-sqs) - Added client_credentials grant type to all OAuth2 providers - Updated temporal-worker-agent service account: - Added queue:send role - Added sqs_queues=* claim - Provisioning script now creates 6 OAuth2 providers (all complete) - All groups, scopes, and service accounts ready for Phase 2 Updated 2026-09-12 in provision-rbac.py