diff --git a/REFACTORING-AUDIT.md b/REFACTORING-AUDIT.md
index 4b0063f..da0f1e4 100644
--- a/REFACTORING-AUDIT.md
+++ b/REFACTORING-AUDIT.md
@@ -306,6 +306,7 @@ The current composition root is `cmd/serve.go`; `repository.System` aggregates P
 
 - Extracted case-insensitive route/method evaluation and privileged-role detection into `application/permission`, retaining development-mode bypass and existing gRPC error mapping; focused and full Auth tests pass in `9f97cec`.
 - Runtime-wired the permission repository adapter and routed permission initialization lookup/creation plus super-admin listing through the domain port, retaining legacy fallback; full Auth tests pass in `5b61adf`.
+- Added an application role-permission reader and infrastructure adapter over the existing Redis/Postgres cache-aside path, then routed standard-user permission reads through it; full Auth tests pass in `24722cb`.
 - A006 remains in progress: permission repository wiring and identity application orchestration still need extraction.
 - A005 remains in progress: JWT validation, session checks, refresh-token flow, and broader authentication orchestration still need application ports and adapters.
 
diff --git a/REFACTORING-TODO.md b/REFACTORING-TODO.md
index f43b398..a6a45d1 100644
--- a/REFACTORING-TODO.md
+++ b/REFACTORING-TODO.md
@@ -109,7 +109,7 @@ This is the authoritative execution tracker for the refactor. Work is performed
 | A003 | `STARTED` | Move auth persistence and Redis implementations into infrastructure. | Explicit mappings and domain-port adapters now cover users, identities, sessions, permissions, roles, role-permissions, bank information, OTP templates, and cache; legacy repository integration and ownership migration remain. |
 | A004 | `DONE` | Extract OTP application use cases and thin gRPC adapters. | OTP primitives, persistence/provider adapters, runtime/template wiring, and thin gRPC registration adapters are in place; full Auth tests pass. |
 | A005 | `DONE` | Extract authentication/JWT application use cases and adapters. | Token policies, JWT verification, cached/persistent session reads, and session writes are extracted and runtime-wired while preserving access/refresh expiry semantics. |
-| A006 | `STARTED` | Extract identity and permission use cases and adapters. | Permission policy and repository-backed route initialization/super-admin reads are extracted; role-linked reads and identity orchestration remain. |
+| A006 | `STARTED` | Extract identity and permission use cases and adapters. | Permission policy, direct repository reads, and cached role-linked reads are extracted/runtime-wired; identity orchestration remains. |
 | A007 | `TODO` | Replace auth bootstrap with explicit dependency composition. | Dependency direction is enforced and the service builds. |
 | A008 | `TODO` | Remove superseded auth packages and compatibility shims. | No dead imports or duplicate implementations remain. |
 
@@ -307,3 +307,4 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-30 | A005 | `STARTED` | `DONE` | Routed refresh lookup through the persistent session boundary (distinct from access-session cache lookup); full Auth tests and vet pass in `016d705`. |
 | 2026-08-30 | A006 | `TODO` | `STARTED` | Extracted case-insensitive route/method and privileged-role permission policy into `application/permission`; full Auth tests pass in `9f97cec`. |
 | 2026-08-30 | A006 | `STARTED` | `STARTED` | Runtime-wired the permission repository port for route lookup/creation and super-admin permission listing; full Auth tests pass in `5b61adf`. |
+| 2026-08-30 | A006 | `STARTED` | `STARTED` | Added and runtime-wired a role-permission reader preserving the existing Redis/Postgres behavior; full Auth tests pass in `24722cb`. |