id: railiance-platform-credential-grants
system: railiance-platform
resources:
  - id: credential-grant:rapp-postgres/audit-core-runtime
    type: credential-grant
    owner: team:platform-security
    attributes:
      grant_id: rapp-postgres/audit-core-runtime
      credential_type: openbao-database-credential
      issuer: openbao
      audience: audit-core
      max_ttl_seconds: 3600
      allowed_actor_types: [human-operator, approved-agent, ci-runner]
      allowed_purposes: [audit-core-runtime]
      allowed_delivery_modes: [exec-env]
  - id: credential-grant:rapp-postgres/audit-core-migration
    type: credential-grant
    owner: team:platform-security
    attributes:
      grant_id: rapp-postgres/audit-core-migration
      credential_type: openbao-database-credential
      issuer: openbao
      audience: audit-core
      max_ttl_seconds: 1800
      allowed_actor_types: [human-operator, approved-agent, ci-runner]
      allowed_purposes: [audit-core-migration]
      allowed_delivery_modes: [exec-env]
  - id: credential-grant:ops-warden/warden-sign
    type: credential-grant
    owner: team:platform-security
    attributes:
      grant_id: ops-warden/warden-sign
      credential_type: openbao-token
      issuer: openbao
      audience: ops-warden
      max_ttl_seconds: 3600
      allowed_actor_types: [human-operator, approved-agent, ci-runner]
      allowed_purposes: [flex-auth-openbao-smoke, ops-warden-production-sign-smoke]
      allowed_delivery_modes: [exec-env, response-wrap, local-token-file, kubernetes-auth]
actions: [issue]
caring_profile: caring-0.4.0-rc2
metadata:
  flex_auth_contract: resource-registration-v0
  tenant: tenant:platform