Public-works InfiniBand expansion adds new HCA GUIDs. What PKey action should operators take?

When public-works InfiniBand expansion adds new HCA GUIDs, operators must update InfiniBand PKey membership as those municipal hosts are onboarded. New GUIDs do not automatically inherit the correct tenant partitions; membership must be explicitly planned so hosts join the right public-works partitions and not unrelated agency domains. Treating membership update as part of host onboarding keeps isolation continuous during growth. Relying on OpenSM discovery to populate PKey membership automatically fails by concept: discovery does not assign the correct tenant partitions, so hosts remain unable to join intended tenants, creating avoidable outages and reactive security gaps. Placing new GUIDs in the default management PKey for isolation fails because it does not enroll hosts in their intended tenant partitions, leaving municipal workloads unreachable and breaking isolation across agencies. Refreshing subnet manager LID assignments for the expanded municipal fabric fails because LID reassignment does not configure PKey membership; new GUIDs still require explicit partition joins, and refreshing LIDs alone does not onboard hosts into correct tenant domains. Exam caveat: GUID onboarding and PKey membership updates are paired operational steps on multi-tenant IB fabrics; expansion is not a license to wipe or over-grant partitions. Operational check: for each new public-works HCA GUID, add it only to the approved PKeys with the correct membership type, verify the host joins the intended partition, confirm it is absent from unrelated agency PKeys, and update the civic tenancy register.