diff --git a/k8s/infra/iam/scripts/authentik-provision.py b/k8s/infra/iam/scripts/authentik-provision.py
index de92acd..702b0b7 100644
--- a/k8s/infra/iam/scripts/authentik-provision.py
+++ b/k8s/infra/iam/scripts/authentik-provision.py
@@ -174,6 +174,7 @@ GROUP_PERMISSIONS = {
     "llm-admins": ["llm:read", "llm:write"],
     "paperless-admins": ["paperless:read", "paperless:write"],
     "immich-admins": ["immich:read", "immich:write"],
+    "poimen-memory-admins": ["poimen-memory:read", "poimen-memory:write"],
     "k8s-devops-admin": ["k8s:devops"],
 }
 perms = set()
@@ -265,7 +266,8 @@ homelab_admins = get_or_create(
 SERVICE_ADMIN_GROUP_NAMES = [
     "grafana-admins", "minio-admins", "forgejo-admins", "homarr-admins",
     "portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins",
-    "paperless-admins", "immich-admins", "k8s-devops-admin",
+    "paperless-admins", "immich-admins", "poimen-memory-admins",
+    "k8s-devops-admin",
 ]
 service_admin_groups = {}
 for group_name in SERVICE_ADMIN_GROUP_NAMES:
diff --git a/k8s/infra/rbac/kustomization.yaml b/k8s/infra/rbac/kustomization.yaml
index 7891be7..cf23c44 100644
--- a/k8s/infra/rbac/kustomization.yaml
+++ b/k8s/infra/rbac/kustomization.yaml
@@ -14,6 +14,7 @@ resources:
   - kmsvc-operator-role.yaml
   - temporal-operator-role.yaml
   - llm-serving-operator-role.yaml
+  - poimen-memory-operator-role.yaml
 # paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
 # that app already has its own kustomization + namespace, no need to
 # duplicate it here. All of these stay inert (grant nothing) until
diff --git a/k8s/infra/rbac/poimen-memory-operator-role.yaml b/k8s/infra/rbac/poimen-memory-operator-role.yaml
new file mode 100644
index 0000000..768e868
--- /dev/null
+++ b/k8s/infra/rbac/poimen-memory-operator-role.yaml
@@ -0,0 +1,33 @@
+# Scoped operator access for poimen-memory-admins: the poimen-memory
+# deployment + its own config/secrets only. memory-db-* (CNPG-managed) and
+# poimen-git-info/poimen-secrets-* (owned by poimen's own repo/ArgoCD app,
+# not this one) are excluded. Inert until kube-apiserver's OIDC wiring lands
+# (--oidc-groups-claim=groups, --oidc-groups-prefix=oidc:).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: poimen-memory-operator
+  namespace: poimen
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    resourceNames: ["poimen-memory"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["poimen-memory-api-key", "poimen-memory-secrets"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: poimen-memory-admins-binding
+  namespace: poimen
+subjects:
+  - kind: Group
+    name: "oidc:poimen-memory-admins"
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: poimen-memory-operator
+  apiGroup: rbac.authorization.k8s.io