Enabled Drive+Sheets APIs, created cai-platform-writer service account under cai-yttcom. Google org-wide policy iam.managed.disableServiceAccountKeyCreation blocked JSON key download even after successful account creation - fixed via a project-scoped policy override (Organization Policies -> Override parent policy -> Enforcement Off for cai-yttcom specifically), requiring Organization Policy Administrator role first. JSON key downloaded successfully. Folder sharing and gdrive-api.php build (Server[40] Step 2) remain open - SOP-GDRIVE-SERVICE-ACCOUNT.md updated to v1.1 with full detail.