diff --git a/docs/secret-grants.md b/docs/secret-grants.md
index d770e23..236aabd 100644
--- a/docs/secret-grants.md
+++ b/docs/secret-grants.md
@@ -10,7 +10,7 @@ gets one reviewed grant.
 | --- | --- | --- | --- |
 | `build` | declared `apps/<app>/<secret>` entries | `tekton-pipelines` | Read-only dependency credentials |
 | `publish` | declared `apps/<app>/<secret>` entries | `tekton-pipelines` | One app's artifact repository credential |
-| `runtime` | declared `apps/<app>/<secret>` entries | `<app>-<environment>` | Service runtime credentials |
+| `runtime` | declared `apps/<app>/<secret>` entries | `staging` or `production` | Service runtime credentials |
 | shared | `shared/<name>/*` | Granted consumer only | Deliberately shared broker, database, or API credentials |
 
 `build` code is repository-controlled. Anything granted to it is readable by a
@@ -118,8 +118,8 @@ spec:
 ```
 
 The workload references only `orders-api-rabbitmq` in its own namespace. Each
-application/environment needs a separate namespace; do not put runtime
-secrets in shared `staging` or `production` namespaces.
+application gets a dedicated ServiceAccount, SecretStore, and target Secret in
+the shared environment namespace; do not use another application's identity.
 
 ## Artifact repositories
 
diff --git a/internal/openbao/bootstrap.go b/internal/openbao/bootstrap.go
index 78c3e00..2b123e8 100644
--- a/internal/openbao/bootstrap.go
+++ b/internal/openbao/bootstrap.go
@@ -400,7 +400,7 @@ func ConfigureSecretGrants(kubeconfig, identityPath, bundlePath string, grants [
 		namespace := "tekton-pipelines"
 		if grant.Consumer == "runtime" {
 			name += "-" + grant.Environment
-			namespace = grant.Application + "-" + grant.Environment
+			namespace = grant.Environment
 		}
 		script.WriteString("cat >/tmp/" + name + ".hcl <<'EOF'\n")
 		for _, secret := range grant.Secrets {
diff --git a/internal/openbao/bootstrap_test.go b/internal/openbao/bootstrap_test.go
index b9f9870..6dc93e4 100644
--- a/internal/openbao/bootstrap_test.go
+++ b/internal/openbao/bootstrap_test.go
@@ -153,7 +153,7 @@ func TestConfigureSecretGrantsScopesApplicationAndSharedPaths(t *testing.T) {
 		`secret/data/shared/artifact-cache/*`,
 		`secret/data/shared/rabbitmq/*`,
 		`bound_service_account_names=maidn-orders-api-publish`,
-		`bound_service_account_namespaces=orders-api-production`,
+		`bound_service_account_namespaces=production`,
 	} {
 		if !strings.Contains(script, want) {
 			t.Fatalf("secret grant script missing %q: %s", want, script)