ClusterRole only had get/list/watch/update/patch on temporalworkers (inherited from a combined queues+temporalworkers rule), missing create needed by reconcileTemporalWorker's cross-namespace (sqs -> temporal) CreateOrUpdate call. Split into separate rule blocks per resource so each carries its own correct verb set. Co-Authored-By: Claude Sonnet 5 <[email protected]>