diff --git a/packages/spec/src/identity/eval-user.zod.ts b/packages/spec/src/identity/eval-user.zod.ts
index d393350ad59..c34eaed9b18 100644
--- a/packages/spec/src/identity/eval-user.zod.ts
+++ b/packages/spec/src/identity/eval-user.zod.ts
@@ -165,8 +165,9 @@ export const ADMIN_FULL_ACCESS_CAPABILITIES: Pick<PermissionSet, 'objects' | 'sy
     'manage_mailboxes',
     // [ADR-0143 D5] The connector connection capability: its holder connects,
     // reconnects and revokes its organization's OAuth2 connector connections.
-    // Platform administrators hold it by default; every other position, the
-    // organization administrator included, only by explicit grant.
+    // Platform administrators hold it by default, and so do organization
+    // administrators (ruling B, record 6545223261); every other position only
+    // by explicit grant.
     'manage_connector_connections',
   ],
 };
diff --git a/packages/spec/src/identity/platform-admin-capabilities.test.ts b/packages/spec/src/identity/platform-admin-capabilities.test.ts
index 392c5411ae3..a0a5df434f9 100644
--- a/packages/spec/src/identity/platform-admin-capabilities.test.ts
+++ b/packages/spec/src/identity/platform-admin-capabilities.test.ts
@@ -50,9 +50,13 @@ describe('ADMIN_FULL_ACCESS_CAPABILITIES — the one platform-admin list plugin-
   });
 
   it('carries the connector connection capability, declared org-scoped (ADR-0143 D5)', () => {
-    // Platform administrators hold it by default through this grant; the
-    // organization administrator's shipped sets withhold it, pinned on the
-    // seeded sets in plugin-security's `default-permission-sets.test.ts`.
+    // Platform administrators hold it by default through this grant. The two
+    // organization-administrator sets hold it by default too (ruling B, record
+    // 6545223261), and every other shipped set withholds it: the exact holder
+    // list is pinned by the `[ADR-0143 D5] the connector connection capability
+    // ships with the platform administrator and both organization-administrator
+    // sets, and no other` case in plugin-security's
+    // `default-permission-sets.test.ts`.
     expect(ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions).toContain('manage_connector_connections');
     expect(PLATFORM_CAPABILITIES.find((c) => c.name === 'manage_connector_connections')?.scope).toBe('org');
   });
diff --git a/packages/spec/src/security/capabilities.ts b/packages/spec/src/security/capabilities.ts
index 94296c2ae59..74e9a09dd4b 100644
--- a/packages/spec/src/security/capabilities.ts
+++ b/packages/spec/src/security/capabilities.ts
@@ -104,10 +104,12 @@ export const PLATFORM_CAPABILITIES: readonly PlatformCapability[] = [
   // (`/automation/connectors/:name/connection` and the OAuth callback, in
   // `@objectstack/runtime`) asks this capability and nothing else — never the
   // platform-scoped `manage_metadata`. Held by default by platform
-  // administrators (`ADMIN_FULL_ACCESS_CAPABILITIES`); every other position,
-  // the organization administrator included, only by explicit grant. `org`:
-  // the door acts on the caller's own organization's connection, and the
-  // holder never sees a token.
+  // administrators (`ADMIN_FULL_ACCESS_CAPABILITIES`) and by organization
+  // administrators (the shipped `organization_admin` and
+  // `organization_admin_no_bypass` sets, ruling B, record 6545223261); every
+  // other position only by explicit grant. `org`: the door acts on the
+  // caller's own organization's connection, and the holder never sees a
+  // token.
   { name: 'manage_connector_connections', label: 'Manage Connector Connections', description: 'Connect, reconnect and revoke the holder’s organization’s connection of an OAuth2 connector instance, and read its status. A connection authorizes the platform to call the vendor on the organization’s behalf; no token is ever shown to the holder.', scope: 'org' },
 ];