diff --git a/components/argocd/hooks/postDelete/controlplane/controlplaneCleaning.yaml b/components/argocd/hooks/postDelete/controlplane/controlplaneCleaning.yaml
index 4932715..bb901a7 100644
--- a/components/argocd/hooks/postDelete/controlplane/controlplaneCleaning.yaml
+++ b/components/argocd/hooks/postDelete/controlplane/controlplaneCleaning.yaml
@@ -11,6 +11,12 @@ metadata:
 spec:
   template:
     spec:
+      # NOTE (FIND-013 / OSPRH-32425): This post-delete hook runs as the shared ArgoCD
+      # SA which carries the full gitops-openstack ClusterRole. The hook is an example
+      # pattern for CI/lab environments; it only needs delete on openstackcontrolplanes
+      # in the openstack namespace. For production use, replace with a dedicated SA
+      # bound to a minimal Role scoped to that single verb/resource/namespace, and set
+      # automountServiceAccountToken: true only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller
       restartPolicy: Never
       securityContext:
diff --git a/components/argocd/hooks/postDelete/dataplane/OpenStackDataPlaneService-deletion.yaml b/components/argocd/hooks/postDelete/dataplane/OpenStackDataPlaneService-deletion.yaml
index 30a38de..b024c53 100644
--- a/components/argocd/hooks/postDelete/dataplane/OpenStackDataPlaneService-deletion.yaml
+++ b/components/argocd/hooks/postDelete/dataplane/OpenStackDataPlaneService-deletion.yaml
@@ -11,6 +11,12 @@ metadata:
 spec:
   template:
     spec:
+      # NOTE (FIND-013 / OSPRH-32425): This post-delete hook runs as the shared ArgoCD
+      # SA which carries the full gitops-openstack ClusterRole. The hook is an example
+      # pattern for CI/lab environments; it only needs delete on openstackdataplaneservices
+      # in the openstack namespace. For production use, replace with a dedicated SA
+      # bound to a minimal Role scoped to that single verb/resource/namespace, and set
+      # automountServiceAccountToken: true only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller
       restartPolicy: Never
       securityContext:
diff --git a/components/argocd/hooks/postDelete/deploy-operators/observability-csv.yaml b/components/argocd/hooks/postDelete/deploy-operators/observability-csv.yaml
index f2d0502..c2310b5 100644
--- a/components/argocd/hooks/postDelete/deploy-operators/observability-csv.yaml
+++ b/components/argocd/hooks/postDelete/deploy-operators/observability-csv.yaml
@@ -11,6 +11,12 @@ metadata:
 spec:
   template:
     spec:
+      # NOTE (FIND-013 / OSPRH-32425): This post-delete hook runs as the shared ArgoCD
+      # SA which carries the full gitops-openstack ClusterRole. The hook is an example
+      # pattern for CI/lab environments; it only needs delete on ClusterServiceVersions
+      # in openshift-operators. For production use, replace with a dedicated SA bound
+      # to a minimal Role scoped to that single verb/resource/namespace, and set
+      # automountServiceAccountToken: true only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller
       restartPolicy: Never
       securityContext:
diff --git a/components/utilities/approve-installplan/job.yaml b/components/utilities/approve-installplan/job.yaml
index 09c6eb3..e5348c4 100644
--- a/components/utilities/approve-installplan/job.yaml
+++ b/components/utilities/approve-installplan/job.yaml
@@ -174,4 +174,13 @@ spec:
 
               log "Job completed successfully."
       restartPolicy: Never
+      # NOTE (FIND-013 / OSPRH-32425): This Job runs as the shared ArgoCD SA which
+      # carries the full gitops-openstack ClusterRole. The approve-installplan pattern
+      # is a CI/lab convenience to handle Manual installPlanApproval without human
+      # intervention; it is not intended for production environments. When OLM v2
+      # (ClusterExtension API) becomes standard, InstallPlan approval is replaced by
+      # version pinning in Git and this Job will no longer be needed. For production
+      # use, create a dedicated SA bound only to a Role granting get/list/patch on
+      # installplans in the target namespace, with automountServiceAccountToken: true
+      # only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller