diff --git a/docs/conclusion.md b/docs/conclusion.md
index 36885aa7..cdbc5261 100644
--- a/docs/conclusion.md
+++ b/docs/conclusion.md
@@ -91,7 +91,7 @@ safe-outputs:
 The job downloads the `safe_outputs` artifact, reads
 `safe-outputs-executed.ndjson`, checks upstream Agent / Detection /
 SafeOutputs job results, and then files or comments on Azure DevOps
-work items using `SYSTEM_ACCESSTOKEN`.
+work items using `SYSTEM_ACCESSTOKEN` (or `SC_WRITE_TOKEN` when a write service connection is configured).
 
 Per-tool config is passed from the compiler to `conclusion.js` as
 individual flat env vars per field (e.g. `AW_NOOP_TITLE_PREFIX`,
diff --git a/prompts/create-ado-agentic-workflow.md b/prompts/create-ado-agentic-workflow.md
index a5b7b2c4..ce3b9c78 100644
--- a/prompts/create-ado-agentic-workflow.md
+++ b/prompts/create-ado-agentic-workflow.md
@@ -33,7 +33,7 @@ If interactive, ask only missing essentials first.
 ### 2. Build Front Matter
 Use only required keys plus task-required options:
 - `name`, `description`
-- optional: `target`, `engine`, `workspace`, `pool`, `repos`, `tools`, `runtimes`, `mcp-servers`, `safe-outputs`, `on`, `steps`, `setup`, `teardown`, `permissions`, `parameters`
+- optional: `target`, `engine`, `workspace`, `pool`, `repos`, `tools`, `runtimes`, `mcp-servers`, `safe-outputs`, `on`, `steps`, `post-steps`, `setup`, `teardown`, `permissions`, `parameters`, `execution-context`, `variable-groups`, `env`
 
 Rules:
 - Omit fields that equal defaults.