diff --git a/aws/projects/adsd-chris/README.md b/aws/projects/adsd-chris/README.md
index e78279ac..2176d79a 100644
--- a/aws/projects/adsd-chris/README.md
+++ b/aws/projects/adsd-chris/README.md
@@ -41,6 +41,9 @@ The components of AWS which integrate with Active Directory require some AD cons
    * userame/password to configure the service
    * cannot use a gMSA
    * Automatic rotation may be possible with custom Lambdas
+1. Groups
+   * One group for the FSx Windows to manage the file system
+   * No group is needed for RDS
 
 The proposed structure is this:
 
@@ -52,6 +55,8 @@ dc=boc,dc=ad,dc=census,dc=gov/
         │   └── OU={base-label-format}-{short-region}
         └── OU=Service Accounts
             └── cn=svc-{purpose}-{base-label-format}-{short-region}
+        └── OU=Groups
+            └── cn=adm-{purpose}-{base-label-format}-{short-region}
 ```
 
 For the service account username:
@@ -71,3 +76,18 @@ The OU object will contain a description showing the AWS Account ID and the AWS
 
 The reason behind the region here is so we can create the specific resources within code in the AWS account in each region,
 though this is up for dicusssion.
+
+Ideally, we want to create the following with Terraform code:
+
+* one-time OU structure
+* per-account OU structure (under OU=Computers)
+* per-account service accounts (so we can generate the password in code)
+* per-account groups
+* group membership
+
+We may not be able to set the permissions for limited delegation (allow service account to write only to its own OU={account},OU=Computers)
+with LDAP attributes, or to be able to set GPOs (though I think on the top levels, we want to prevent inheritance).
+
+It may be possible to have some PowerShell on the AWS domain controllers that we can initiate from TF to make the needed account-level
+setups.
+