Was hardcoded to webapp/demo-go-app — any future app added to this project needed its own policy line. Wildcarding to webapp/* means any app onboarded into that project (project: webapp in its Application manifest) is automatically covered, no RBAC change needed per app. Platform-level apps on the default project are unaffected.