Summary

Sam approved two access-hardening items from the Rank Math sitemap authority closeout: provision a GSC owner/full-user service account for sitemap mutation only, and add Bing Webmaster Tools access to the canonical vault and Notion secrets.

What was completed

• Created Google Cloud service account claude-agent-gsc-owner@project-claude-489923.iam.gserviceaccount.com in project-claude-489923.
• Generated the local JSON key at /Users/samaguiar/Documents/Projects/.credentials/gsc-owner-service-account.json.
• Confirmed key file mode is 0600.
• Added GSC_OWNER_SERVICE_ACCOUNT_JSON to local vault.env.
• Added Bing WMT target vars to local vault.env: BING_WEBMASTER_SITE_URL and BING_WEBMASTER_SITEMAP_URL.
• Left BING_WEBMASTER_API_KEY as an explicit pending comment because no actual Bing WMT key was available.
• Updated local credential documentation: .credentials/CREDENTIAL-INDEX.md, AGENT-TOOL-MANIFEST.md, and admin/handoff-audit/2026-05-04-gsc-owner-sa-provisioning.md.
• Added Notion comments to both canonical secret surfaces: API Keys & App Secrets and A - Passwords.
• Committed and pushed documentation changes on agent/restoration-continue-2026-04-24.

Verification

• gcloud iam service-accounts create succeeded.
• gcloud iam service-accounts keys create succeeded.
• Python readback confirmed owner key email: claude-agent-gsc-owner@project-claude-489923.iam.gserviceaccount.com.
• Python readback confirmed env variables source correctly from vault.env.
• Owner SA can mint a webmasters OAuth token.
• Search Console API submit still returns 403, which proves the remaining blocker is Search Console property-level permission, not Google Cloud service-account provisioning.
• Bing WMT search across vault, credential index, manifest, local Notion exports, and live Notion search found no Bing WMT API key. Playwright visit to https://www.bing.com/webmasters/apikey landed on the public/about page, not an authenticated account page.