Sam approved two access-hardening items from the Rank Math sitemap authority closeout: provision a GSC owner/full-user service account for sitemap mutation only, and add Bing Webmaster Tools access to the canonical vault and Notion secrets.
claude-agent-gsc-owner@project-claude-489923.iam.gserviceaccount.com in project-claude-489923./Users/samaguiar/Documents/Projects/.credentials/gsc-owner-service-account.json.0600.GSC_OWNER_SERVICE_ACCOUNT_JSON to local vault.env.vault.env: BING_WEBMASTER_SITE_URL and BING_WEBMASTER_SITEMAP_URL.BING_WEBMASTER_API_KEY as an explicit pending comment because no actual Bing WMT key was available..credentials/CREDENTIAL-INDEX.md, AGENT-TOOL-MANIFEST.md, and admin/handoff-audit/2026-05-04-gsc-owner-sa-provisioning.md.API Keys & App Secrets and A - Passwords.agent/restoration-continue-2026-04-24.gcloud iam service-accounts create succeeded.gcloud iam service-accounts keys create succeeded.claude-agent-gsc-owner@project-claude-489923.iam.gserviceaccount.com.vault.env.webmasters OAuth token.403, which proves the remaining blocker is Search Console property-level permission, not Google Cloud service-account provisioning.https://www.bing.com/webmasters/apikey landed on the public/about page, not an authenticated account page.