diff --git a/lab/lesson-32-answer.md b/lab/lesson-32-answer.md
new file mode 100644
index 0000000..938153f
--- /dev/null
+++ b/lab/lesson-32-answer.md
@@ -0,0 +1,24 @@
+1. The failed request was an attempt by `system:serviceaccount:default:unknown`
+to create ClusterRoleBinding `unknown-admin`. Response code `403` and status
+`Failure` prove that the API server rejected the request.
+
+2. the requested principle came from system:serviceaccount:checkout:release-bot
+
+3. first successful escalation event is audit ID: b3, timestamp: 2026-08-25T04:22:11Z, verb: create, resourcetype: rolebindings, namespace: checkout, resourceName: release-bot-secret-reader
+
+4. Secret `checkout/payment-gateway` was accessed successfully with a `get`
+request that returned HTTP 200.
+
+5.  The principal opened a `pods/exec` session in Pod
+`checkout/checkout-api-6d8f`; HTTP 101 shows the connection was upgraded.
+
+6. First, delete RoleBinding
+`checkout/release-bot-secret-reader` to revoke the escalated Secret access.
+
+Second, isolate or stop the workload using ServiceAccount
+`checkout/release-bot`, and terminate its access to Pod
+`checkout/checkout-api-6d8f`.
+
+Third, rotate the credential stored in Secret
+`checkout/payment-gateway`, update its authorized consumers, and invalidate the
+old credential.
\ No newline at end of file