diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml
index 019afc9..c9c1c70 100644
--- a/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml
+++ b/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml
@@ -108,9 +108,17 @@ argo-cd:
     # role:admins / role:backend / GitHub-team policy.csv and real teammate
     # emails from the source cluster are dropped here.
     rbac:
+      # Scoped to the whole webapp project, not one app name — this is
+      # exactly what that AppProject exists for (projects/webapp.yaml in
+      # devops-argo-config). Any future app onboarded into it (project:
+      # webapp in its Application manifest) is automatically covered by
+      # jenkins-ci's sync/get access with zero RBAC changes needed here.
+      # Platform-level apps (argocd, gitea, vault, contour,
+      # external-secrets, jenkins, harbor) stay on the default project,
+      # untouched by this policy.
       policy.csv: |
-        p, jenkins-ci, applications, sync, webapp/demo-go-app, allow
-        p, jenkins-ci, applications, get, webapp/demo-go-app, allow
+        p, jenkins-ci, applications, sync, webapp/*, allow
+        p, jenkins-ci, applications, get, webapp/*, allow
     repositories:
       devops-infra-helm-charts:
         url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git