# Bootstrap a Shared Inert BYOC Account-Setup Principal

The pinned official customer account-setup template creates the customer
`auto-deploy-cli` role with a trust principal fixed to
`arn:aws:iam::<control-plane-account>:role/auto-deploy-cli`. AWS validates that
principal while creating the customer role and rejects the stack when the
control-plane role does not already exist. Production satisfies this contract
through its management-account bootstrap; the CP9 runtime account must do the
same even though CP9 does not run production auto-deploy from that identity.

`terraform/cp9-developer/SKILL.md` therefore owns one account-level compatibility
role with the exact name `auto-deploy-cli`. The role is deliberately inert: its
trust policy is a single explicit deny for `sts:AssumeRole`, it has no managed
or inline policies, no permissions boundary, and no instance profile. It
carries a durable non-empty `cp9-owner` plus exact CP9 component tags but never
a `cp9-session` tag. The real BYOC runtime identity remains the
session-prefixed control-plane DPM role and the
two-hop chain defined by ADR 0034; no service or operator uses this compatibility
role for credentials.

Before customer mutation, `cp9 byoc activate` reads the live role through the
resolved control-plane profile and requires the exact ARN, root path, deny-only
trust, inert policy/profile shape, and account-level tags. Missing or drifted
state fails closed with the `terraform/cp9-developer/SKILL.md` remediation. CP9 never
creates, adopts, updates, or deletes the role inside a session lifecycle.

The fixed role is shared by all BYOC sessions using the control-plane account.
Making it session-owned would let one session's destroy invalidate another
session's customer CloudFormation dependency, so normal destroy retains it and
reports it as an excluded control-plane account prerequisite. Exact session
zero-residual proof continues to cover every session-owned object in both
accounts; it excludes this named shared bootstrap resource in addition to the
customer DNS/PCA prerequisites and retained customer ECR cache.

Dedicated registration is a separate floor:
[`terraform/aws/init-dedicated-dataplane/SKILL.md`](../../terraform/aws/init-dedicated-dataplane/SKILL.md).
Present `auto-deploy-cli` trust stays. Do not convert an inert BYOC-only
prerequisite into the Dedicated trust contract without first reviewing the
resulting BYOC activation.