Add bounded resource audiences and enforce browser scope grants

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

config/service-clients.example.yaml

@@ -1,5 +1,4 @@
-# Non-secret static registration fragments for KeyCape's bounded OpenBao JWT
-# consumers. Merge these entries into the deployment-owned KeyCape config.
+# Non-secret static registration fragments for KeyCape's bounded JWT consumers. Merge these entries into the deployment-owned KeyCape config.
 # The named environment variables must be materialized by an approved
 # out-of-repository custody path; this file never contains their values.
 clients:
@@ -24,3 +23,27 @@ clients:
     tenant: "tenant:coulomb"
     roles: ["secrets-engine"]
     tokenLifetime: "15m"
+
+  - clientId: "secrets-engine-approval"
+    displayName: "secrets-engine approval consume client"
+    audience: "approval-engine"
+    allowedScopes: ["approval:read", "approval:consume"]
+    grantTypes: ["client_credentials"]
+    clientType: "confidential"
+    secretRef: "env:KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET"
+    serviceSubject: "service:secrets-engine"
+    tenant: "tenant:coulomb"
+    roles: ["secrets-engine"]
+    tokenLifetime: "15m"
+
+  - clientId: "approval-engine-operator"
+    displayName: "approval-engine lifecycle operator"
+    audience: "approval-engine"
+    allowedScopes: ["approval:create", "approval:read", "approval:approve", "approval:revoke", "approval:supersede", "approval:observe", "approval:emit"]
+    grantTypes: ["client_credentials"]
+    clientType: "confidential"
+    secretRef: "env:KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET"
+    serviceSubject: "service:approval-engine-operator"
+    tenant: "tenant:coulomb"
+    roles: ["approval-operator"]
+    tokenLifetime: "15m"