From 6252ab8d7e6c1a971ded42bca907e0730c73d693 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 7 Nov 2026 15:38:10 +0100 Subject: [PATCH] NK-WP-0054-T04: rerun on fresh export confirms keycape alias gone; window-scoped executor role Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 149903@bnt-lap001 Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6 --- .../README.md | 24 +- .../openbao-identity-metadata-20261107.json | 6921 +++++++++++++++++ ...postgresql-identity-metadata-20261107.json | 97 + .../report-20261107-rerun.json | 217 + tools/service-identity/observe.py | 7 +- tools/service-identity/tests/test_observe.py | 10 +- .../NK-WP-0054-service-identity-policy.md | 7 +- 7 files changed, 7276 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/openbao-identity-metadata-20261107.json create mode 100644 docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/postgresql-identity-metadata-20261107.json create mode 100644 docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/report-20261107-rerun.json diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md index 067f708..64d8a70 100644 --- a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md @@ -56,5 +56,25 @@ Two earlier dry runs failed inside the helper, before any change: one left no re `4d70743`. On the first attempt WSL interop timeouts kept Edge from opening. On another, Authelia once dropped the OIDC flow to its default URL, `users.coulomb.social`. -Still open: railiance-platform removes the alias from its declarations (message `051b7391`), and a fresh export -confirms the change with `make service-identity-observe`. +Still open: railiance-platform removes the alias from its declarations (message `051b7391`). + +## Rerun on a fresh export, 2026-11-07 14:40Z + +The founder re-exported with the RPF-WP-0067-T03 commands. Both exited 0, and no secret-shaped values were found. + +| File | SHA-256 | collected_at | +|---|---|---| +| `openbao-identity-metadata-20261107.json` | `58ceec665c8cbe6f3214d24307bbb584e63362ca51c30920db21ecdfdebd3cc7` | 2026-11-07T14:34:38Z | +| `postgresql-identity-metadata-20261107.json` | `76fd1d795b3597fa44ab971c452956e4d3173230bd1d8b0e8708f742c1f560b2` | 2026-11-07T14:35:35Z | + +**What changed in the data:** +- Auth mounts are now `approle`, `keycape-services`, `kubernetes`, `netkingdom` and `token`; `keycape` is gone. +- The only role removed since 2026-11-03 is `keycape/platform-admin`. Five executor and window-watch roles were + added. + +`report-20261107-rerun.json` (exit 0): +- **Declared identities:** 6 conformant, 1 unknown (the `netkingdom/platform-admin` max TTL). +- **Undeclared:** 0 non-conformant, 14 unknown. + +The executor's write role `net-kingdom-bind-executor-svc-authelia-write` is absent, which CCR-2026-0058 requires +between admitted runs. The checker now treats that absence as conformant (`window_scoped`). diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/openbao-identity-metadata-20261107.json b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/openbao-identity-metadata-20261107.json new file mode 100644 index 0000000..3d82638 --- /dev/null +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/openbao-identity-metadata-20261107.json @@ -0,0 +1,6921 @@ +{ + "collected_at": "2026-11-07T14:34:38Z", + "openbao": { + "auth_mounts": [ + { + "path": "approle", + "type": "approle" + }, + { + "path": "keycape-services", + "type": "jwt" + }, + { + "path": "kubernetes", + "type": "kubernetes" + }, + { + "path": "netkingdom", + "type": "oidc" + }, + { + "path": "token", + "type": "token" + } + ], + "policies": [ + { + "name": "agent-high-risk-boundary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/agent-harness/forgejo-deploy-key" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/operator-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/audit-core/senders" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/core-hub/runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/email-connect/transactional" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/bounded-executor/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-privacyidea" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/scaleway/bootstrap" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/keycape-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/telemetry/grafana-admin" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/agent-harness/forgejo-deploy-key" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/email-connect/transactional" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/nk-bind-executor-approval" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/bounded-executor/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-authelia" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-keycape" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-privacyidea" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-provisioner" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/publisher" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/retention" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/synthetic-journey/syn-journey" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/railiance-telemetry/smtp" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/scaleway/bootstrap" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/rapp-qonto/audit-sender" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/rapp-qonto/keycape-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/state-hub/repository-rename-preflight" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/telemetry/grafana-admin" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/company-email/imap" + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/qonto-api" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api" + } + ], + "sha256": "ce144850632f88f57dcbfb0ccd78087ed25133bee208a6be831192b2c1a29d7b" + }, + { + "name": "authelia-smtp-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + } + ], + "sha256": "023c502bb72453224d8ba05db75871289f69681e9ae6a8461504c867ef9c0e38" + }, + { + "name": "credential-broker-keycape-client-secret-generate-issuer", + "readable": true, + "rules": [ + { + "capabilities": [ + "create", + "update" + ], + "path": "auth/token/create/keycape-client-secret-generate" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/lookup-accessor" + }, + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-accessor" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + } + ], + "sha256": "a8579858f50f8385857ef1ec85f06c7f3e2378c64391b171a69a852836a84cd1" + }, + { + "name": "email-connect-platform-smtp-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + } + ], + "sha256": "023c502bb72453224d8ba05db75871289f69681e9ae6a8461504c867ef9c0e38" + }, + { + "name": "email-connect-scoped-caller-reader", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/callers/user-engine" + } + ], + "sha256": "cbc57e731c4fd9dbbaf98364de8ff87ed2966df18c2235cf298ffda963bf7553" + }, + { + "name": "external-secrets-audit-core", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-migration" + }, + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/audit-core/senders" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders" + } + ], + "sha256": "0d6afb577ab2f11af750c31664ac8d7a6e9082e5422caf7bb4bd22b053a62886" + }, + { + "name": "keycape-factor-renewer", + "readable": true, + "rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-issuer" + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read" + } + ], + "sha256": "606a7520c19314d13a69677be3fc8ed9c9251e54bd47f051d7137b596c59133a" + }, + { + "name": "net-kingdom-backup-publisher-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher" + } + ], + "sha256": "391e8164cef7661a4ff763c292cad45ebd37b112ade38412aa3e70f4b4156a8a" + }, + { + "name": "net-kingdom-backup-retention-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention" + } + ], + "sha256": "da4602c74911882b9ff7235a88df337a1f338f829fcfbe3f37418afdd09e79b2" + }, + { + "name": "net-kingdom-bind-executor-syn-journey-read", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" + } + ], + "sha256": "39b2fbd5fc796025b123edbc06dcb7983962eb69928890405d551198051cd550" + }, + { + "name": "net-kingdom-bounded-executor-window-watch", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/kubernetes/role/net-kingdom-bind-executor-svc-authelia-write" + }, + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + } + ], + "sha256": "6e3053b1d3768f5120d80200f39f5f24f2ca93563263c9e51d04cb4a3a0d0149" + }, + { + "name": "net-kingdom-svc-authelia-bind-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia" + } + ], + "sha256": "144e65e7c840990bdbc0c879c4033b39d7a725a6079cfe5de854b7e51a312bc5" + }, + { + "name": "net-kingdom-svc-keycape-bind-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape" + } + ], + "sha256": "aa0254a1812655fc9e4abd872273fa4ee3617f3bdb676e4b1e8e59e1b0cdc477" + }, + { + "name": "net-kingdom-svc-provisioner-bind-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner" + } + ], + "sha256": "9e612343d19bb0352c47d4d0b0cd47d3e5b28e45957ffb3ff337613f19cde11e" + }, + { + "name": "operator-custody", + "readable": true, + "rules": [ + { + "capabilities": [ + "create", + "list", + "read", + "update" + ], + "path": "operators/data/*" + }, + { + "capabilities": [ + "list", + "read" + ], + "path": "operators/metadata/*" + } + ], + "sha256": "232210528936999dd57d95ccdb789e9e58f9915a6175048b1a3374c9e3c2dbe3" + }, + { + "name": "platform-admin", + "readable": true, + "rules": [ + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "auth/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "cubbyhole/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "database/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "identity/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "pki/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "platform/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "reins/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "secret/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "ssh/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "sys/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "tenants/*" + } + ], + "sha256": "b015d66541c1a6034dc2e05d72158745f331f1b2c0994844fcd4bb8a2701432c" + }, + { + "name": "se-prod-activity-core-metered-worker-token", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01" + } + ], + "sha256": "c5c9e8167e6b87ad1d5fff3293a39e2a051b336a531bbce518347dee497f5dc6" + }, + { + "name": "se-prod-glas-claude-agent-dev-anthropic", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/glas-harness/claude-agent-dev" + } + ], + "sha256": "2428edb150f8649dd0321eca779a1dc5fa6f2ae8c401f3e7ec5ec026e2fd84fe" + }, + { + "name": "se-prod-openrouter-llm-connect", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + } + ], + "sha256": "fdebaee204fe488a2bd76a5f2d5b053f87b57dc0fac7b0d2fcd10dc443175849" + }, + { + "name": "se-prod-whynot-design-npm-publish", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "secret/data/coulomb/whynot-design/npm/publish" + }, + { + "capabilities": [ + "read" + ], + "path": "secret/metadata/coulomb/whynot-design/npm/publish" + } + ], + "sha256": "fa0e92a3531cff24aa3536763227527291ab7bd2f66624f9421251e8b7178dd8" + }, + { + "name": "secrets-engine-login-self", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/secrets-engine-openbao" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + } + ], + "sha256": "d1a2969dd2949c822972e9b32243650567ac123a669f3fc609e9bfea977bb4eb" + }, + { + "name": "telemetry-grafana-admin-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/telemetry/grafana-admin" + } + ], + "sha256": "6d74223aed2d4e8eef18e8adaef9b510952d3b09ca29cfa66e2d6a035d83f24e" + }, + { + "name": "telemetry-smtp-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + } + ], + "sha256": "023c502bb72453224d8ba05db75871289f69681e9ae6a8461504c867ef9c0e38" + }, + { + "name": "user-engine-root-custody-reader", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/custody/net-kingdom/platform-root" + } + ], + "sha256": "4a0403ff5d49c79d6787123d9854867f3e279ffbc48b68b56b613495ac137c15" + }, + { + "name": "warden-sign", + "readable": true, + "rules": [ + { + "capabilities": [ + "list", + "read" + ], + "path": "ssh/roles" + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/adm-role" + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/agt-role" + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/atm-role" + } + ], + "sha256": "84fc03e0465ce34b50693810be53da34305f59442c656309298b1cdfe16d1b4f" + }, + { + "name": "workload-kv-fluid-telegram-hall-of-helix-operator", + "readable": true, + "rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" + }, + { + "capabilities": [ + "create", + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" + } + ], + "sha256": "5dfc0e60cdd657492bff30adb0bc52de5431b97c62dace70b8561aaae1b6dd75" + }, + { + "name": "workload-kv-read-activity-core-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-railiance01" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane" + } + ], + "sha256": "d75e33703a75b3872fb69d2a2350e765c8b4c8170ad0ed6a9af930d4add30169" + }, + { + "name": "workload-kv-read-approval-engine-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/audit-sender" + } + ], + "sha256": "a527c3bdfe7bf356fcd19f499ebc3ad75a71256a22c19882ad0dfdd09e0f0eb9" + }, + { + "name": "workload-kv-read-backup-object-storage", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/object-storage" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/object-storage" + } + ], + "sha256": "d33e9dbbb6dfcb547374acb9566388811f9228c84685dbaa1bbdf064eb8baf70" + }, + { + "name": "workload-kv-read-binky-company-email-imap", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/company-email/imap" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap" + } + ], + "sha256": "af8f475f07fcf187abc6ea208883b9c9050af045e0a5f37bf80fd5d113cdea11" + }, + { + "name": "workload-kv-read-binky-qonto-api", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/qonto-api" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api" + } + ], + "sha256": "c80f7495e7a829c9370808ed569dab521f4f75ac1062a8ca82eece74d8e39133" + }, + { + "name": "workload-kv-read-core-hub-forgejo-source", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/forgejo-source-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/forgejo-source-read" + } + ], + "sha256": "2fc858d3c2801924bdf28640fd3fecf0267e8814b6bec2f4be1b97b6ad46304f" + }, + { + "name": "workload-kv-read-core-hub-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime" + } + ], + "sha256": "375328abc3a0c6edb62d2c950f3a1cad99f42b3fd793a807f706fd27ffcd0d64" + }, + { + "name": "workload-kv-read-coulomb-social-backup-primary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb-social/backup-primary" + } + ], + "sha256": "1d4a570b04e28dcd54e443a25e98a3a4e163fee6b50760984eb657512c880b90" + }, + { + "name": "workload-kv-read-email-connect-backup-primary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/backup-primary" + } + ], + "sha256": "8ba281e1a5bce9db210d9b807a328cc6c083fa38e0e63eaff1ffad5cd64018f4" + }, + { + "name": "workload-kv-read-email-connect-transactional-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/transactional" + } + ], + "sha256": "ebcdcc1f6bb175ab7557b0de996cf5733af4d621ceefdbd81a4b918090fe2094" + }, + { + "name": "workload-kv-read-forgejo-admin", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin" + } + ], + "sha256": "574551b7358a5363081db3a0c62984e0ea6632fa887e502aafaf7c7b9eac070e" + }, + { + "name": "workload-kv-read-forgejo-mailer-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-mailer" + } + ], + "sha256": "5375172552accb42d2465ea4a6e81548ed5108dae77de5a64227fc4cd065faa7" + }, + { + "name": "workload-kv-read-inbound-library-imap", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/inbound-library/imap" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/inbound-library/imap" + } + ], + "sha256": "cc93bbe0029880f9b1404708270b0f50bd2e54bfcf3e32491a7e32fb43c0cb8c" + }, + { + "name": "workload-kv-read-informed-decision-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/audit-sender" + } + ], + "sha256": "389e952546d32692e87b4f249752a9bee0fafa9fc58bf50ab8904110bf6b3780" + }, + { + "name": "workload-kv-read-informed-decision-sitting-requester-client", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester" + } + ], + "sha256": "87427b0c0247897eb04d4c15284787cee05e5c2fb257998e7f62aee9ed7c66c8" + }, + { + "name": "workload-kv-read-informed-decision-sitting-requester-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + } + ], + "sha256": "b892e40f2b5a08d1c0fe71dac69147067ee21405ef74bf3bf7c4ef4849838f2c" + }, + { + "name": "workload-kv-read-issue-core-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" + } + ], + "sha256": "54b9f864f3435910143a860352aac5ecb3aa2cd7afb5e161bb304c12d821c55e" + }, + { + "name": "workload-kv-read-keycape-approval-engine-operator", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/operator-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client" + } + ], + "sha256": "97957b44511280012eb789e10c00810b546558bb2b9f3a5b212ced1a76d49203" + }, + { + "name": "workload-kv-read-keycape-factor-read", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/net-kingdom/keycape-factor-read" + } + ], + "sha256": "ba89842196d5aac00d12dcfda7342292f1ea789b71b59daf0aa16f925d53e1ab" + }, + { + "name": "workload-kv-read-keycape-forgejo-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/forgejo" + } + ], + "sha256": "f1d6752e3ecb16fac49f88b1d91ecc355021bf2e73e1184c0980822378b8f5d8" + }, + { + "name": "workload-kv-read-keycape-informed-decision-sitting-requester", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester" + } + ], + "sha256": "87427b0c0247897eb04d4c15284787cee05e5c2fb257998e7f62aee9ed7c66c8" + }, + { + "name": "workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval" + } + ], + "sha256": "7d75c09f134baae13133c2bc59ae12503e12aa72550177a703cef9e50804f6ce" + }, + { + "name": "workload-kv-read-keycape-nk-bind-executor-approval-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval" + } + ], + "sha256": "31c37ead64ee9a7cb539f36559b1941a00fb3d69e46767dadb9b45fa0287398f" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-approval", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client" + } + ], + "sha256": "3898d04168f100738d53a7bfb33973b65ef6d68fc1012e23abb45eee8d923f81" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-openbao-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao" + } + ], + "sha256": "55a2b04d3158bc67bd2f8f8f23ff98885af0c35091f4f49a99cdc4638c438af2" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-openbao-operator", + "readable": true, + "rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao" + } + ], + "sha256": "82034d000739f7daaba0b0a106b5cb2ea280e788bbde728190f197b121b5bf2c" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-requester", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester" + } + ], + "sha256": "1524b768403283a9d684ba29191ea3941827090285897de0b23b8e66176331d0" + }, + { + "name": "workload-kv-read-llm-connect-provider-secrets", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + } + ], + "sha256": "4aea84e882c8c677bbf007a78aa528c6a8d9ffb40d01eab574b72fc8ae26f2f1" + }, + { + "name": "workload-kv-read-mas-backup-primary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/mas/backup-primary" + } + ], + "sha256": "d2505ffbe2da3158107114f3b232a0cd81d75d63a4c367047ec39311b81500f0" + }, + { + "name": "workload-kv-read-mas-tem-relay", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/suppliers/scaleway/mas-tem-relay" + } + ], + "sha256": "88267821db36083045f6827702d4bb8e5e71675ea2bab9f9e9a4d198f18865bf" + }, + { + "name": "workload-kv-read-nk-bind-executor-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/bounded-executor/audit-sender" + } + ], + "sha256": "e1aacf5b95de552ec0dad1060a4586f578f5ec5e9d45bfc1ba4ffc7f8739a3fc" + }, + { + "name": "workload-kv-read-policy-nexus-forgejo-source", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/policy-nexus/forgejo-source-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/policy-nexus/forgejo-source-read" + } + ], + "sha256": "ccef3f352633ccc19396b85635401357b0b2e6282aed8238b378791985831806" + }, + { + "name": "workload-kv-read-railiance-backup-offsite-lane", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane" + } + ], + "sha256": "299df57a813bac92b17e49253cf4492b8582b4ec81791e72a44c26f21262ec83" + }, + { + "name": "workload-kv-read-rapp-qonto-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender" + } + ], + "sha256": "2d17cd763c9c36a7fb7110121d30c2e53731d04482412d6f99f98cfe52af3c0c" + }, + { + "name": "workload-kv-read-rein-openweights-openrouter", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "reins/data/rein-openweights/openrouter" + }, + { + "capabilities": [ + "read" + ], + "path": "reins/metadata/rein-openweights/openrouter" + } + ], + "sha256": "76df5b622d3a4634159d92166c221432c8d6a0de55e03c13e0e2a4f028c1f7b9" + }, + { + "name": "workload-kv-read-reuse-surface-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + } + ], + "sha256": "53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257" + }, + { + "name": "workload-kv-read-reuse-surface-runtime-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets" + } + ], + "sha256": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b" + }, + { + "name": "workload-kv-read-secrets-engine-approval-client", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client" + } + ], + "sha256": "3898d04168f100738d53a7bfb33973b65ef6d68fc1012e23abb45eee8d923f81" + }, + { + "name": "workload-kv-read-secrets-engine-requester-client", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester" + } + ], + "sha256": "1524b768403283a9d684ba29191ea3941827090285897de0b23b8e66176331d0" + }, + { + "name": "workload-kv-read-state-hub-forge-derivation", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/forge-derivation" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/state-hub/forge-derivation" + } + ], + "sha256": "514ea0ef31bf1ac32040a72f9cb79be400d09520610b0e06dc411408337d1647" + }, + { + "name": "workload-kv-read-state-hub-rename-preflight", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight" + } + ], + "sha256": "73aba7ffb93e58fe0dd32b9bed3eadf065561453526ad14474f2c5f3ea0edcb7" + }, + { + "name": "workload-kv-read-target-revenue-runtime-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/target-revenue/runtime-secrets" + } + ], + "sha256": "a118ba4111ed695a8c2fb5c9f0920bc473ca3ee5d02897c906632202d34d57f6" + }, + { + "name": "workload-kv-read-tenant-engine-audit-core-sender-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/tenant-engine/audit-core-sender" + } + ], + "sha256": "b9e06bae80fbfd18dfa3279ed9bb8b7fcf4b5fdcad76fbc509fbbb5e99c86b53" + }, + { + "name": "workload-kv-read-user-engine-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/user-engine/runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/user-engine/runtime" + } + ], + "sha256": "2180f09deb36691d59da9f0703a57124f8f185c26b5f45a1317718e543875f2a" + }, + { + "name": "workload-kv-read-whynot-design-npm-publish", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish" + } + ], + "sha256": "5d627c71ffa7c9a6f2ba881623a354bdcb73aacf06b92017c7553ce9e0e21457" + } + ], + "roles": [ + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "agent-harness-binky-mail", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-binky-company-email-imap" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/bounded-executor/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/nk-bind-executor-approval", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/bounded-executor/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "coding-agent-railiance-platform", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 300, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 8, + "token_policies": [ + "agent-high-risk-boundary", + "workload-kv-read-issue-core-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-migration", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-audit-core", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 7200, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "external-secrets-audit-core" + ], + "token_ttl_seconds": 3600, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/object-storage", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/object-storage", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-backup-object-storage", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-backup-object-storage" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-rapp-qonto", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-binky-qonto-api" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/user-engine/runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/user-engine/runtime", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-sso-user-engine", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-user-engine-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/user-engine/runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/user-engine/runtime", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-user-engine", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-user-engine-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/inbound-library/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/inbound-library/imap", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "inbound-library", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-inbound-library-imap" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "reins/data/rein-openweights/openrouter", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "reins/metadata/rein-openweights/openrouter", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "rein-openweights", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-rein-openweights-openrouter" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-activity-core-metered-worker-token", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 300, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "se-prod-activity-core-metered-worker-token" + ], + "token_ttl_seconds": 300, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/glas-harness/claude-agent-dev", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-glas-claude-agent-dev-anthropic", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 300, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "se-prod-glas-claude-agent-dev-anthropic" + ], + "token_ttl_seconds": 300, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-openrouter-llm-connect", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 900, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "se-prod-openrouter-llm-connect" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "secret/data/coulomb/whynot-design/npm/publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "secret/metadata/coulomb/whynot-design/npm/publish", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-whynot-design-npm-publish", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "se-prod-whynot-design-npm-publish" + ], + "token_ttl_seconds": 1800, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "list", + "read" + ], + "path": "ssh/roles", + "wildcard": false + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/adm-role", + "wildcard": false + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/agt-role", + "wildcard": false + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/atm-role", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "warden-sign", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 1800, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "warden-sign" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_audiences": [ + "secrets-engine-openbao" + ], + "bound_claims": { + "principal_type": "service", + "roles": "secrets-engine", + "scope": "openbao:login", + "tenant": "tenant:platform" + }, + "bound_claims_type": "string", + "bound_subject": "service:secrets-engine", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/secrets-engine-openbao", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "mount": "keycape-services", + "mount_type": "jwt", + "name": "secrets-engine-openbao", + "role_type": "jwt", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 8, + "token_policies": [ + "secrets-engine-login-self" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "user_claim": "sub" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "activity-core-eso" + ], + "bound_service_account_namespaces": [ + "activity-core" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-railiance01", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "activity-core-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-activity-core-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "authelia-smtp-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "authelia-smtp-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "authelia-smtp-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "backup-primary-delivery" + ], + "bound_service_account_namespaces": [ + "coulomb-social" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb-social/backup-primary", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "coulomb-social-backup-primary-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-coulomb-social-backup-primary" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "backup-primary-delivery" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/backup-primary", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-backup-primary-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-email-connect-backup-primary" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "email-connect-platform-smtp-eso" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-platform-smtp-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "email-connect-platform-smtp-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "email-connect-scoped-caller-eso" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/callers/user-engine", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-scoped-caller-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "email-connect-scoped-caller-reader" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "email-connect-eso" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/transactional", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-transactional-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-email-connect-transactional-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-activity-core", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-llm-connect-provider-secrets" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-approval-engine-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-approval-engine-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/forgejo-source-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/forgejo-source-read", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-core-hub-forgejo-source", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-core-hub-forgejo-source" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-core-hub-runtime", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-core-hub-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-informed-decision-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-informed-decision-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-issue-core", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-issue-core-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-approval-engine-operator", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-approval-engine-operator" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/forgejo", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-forgejo", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-forgejo-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-informed-decision-sitting-requester", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-informed-decision-sitting-requester" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-nk-bind-executor-approval", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-nk-bind-executor-approval-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-secrets-engine-approval", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-approval" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-secrets-engine-openbao", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-openbao-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-secrets-engine-requester", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-requester" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "mas-tem-relay-eso" + ], + "bound_service_account_namespaces": [ + "mas" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/suppliers/scaleway/mas-tem-relay", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-mas-tem-relay", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-mas-tem-relay" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/bounded-executor/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-nk-bind-executor-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-nk-bind-executor-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-rapp-qonto-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-rapp-qonto-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-reuse-surface", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-reuse-surface-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "forgejo-mailer-eso" + ], + "bound_service_account_namespaces": [ + "forgejo" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-mailer", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "forgejo-mailer-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-forgejo-mailer-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "informed-decision-eso" + ], + "bound_service_account_namespaces": [ + "informed-decision" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "informed-decision-sitting-requester-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-informed-decision-sitting-requester-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "keycape-factor-renewer" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-issuer", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "keycape-factor-renewer", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "keycape-factor-renewer" + ], + "token_ttl_seconds": 300, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "keycape-factor-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/net-kingdom/keycape-factor-read", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "keycape-factor-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-factor-read" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "nk-bind-executor" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "backup-primary-delivery" + ], + "bound_service_account_namespaces": [ + "mas" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/mas/backup-primary", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "mas-backup-primary-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-mas-backup-primary" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-backup-publisher-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-backup-publisher-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-backup-publisher-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-backup-retention-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-backup-retention-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-backup-retention-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "nk-bind-executor" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-bind-executor-syn-journey-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-bind-executor-syn-journey-read" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "nk-window-watch" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/kubernetes/role/net-kingdom-bind-executor-svc-authelia-write", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-bounded-executor-window-watch", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-bounded-executor-window-watch" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-svc-authelia-bind-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-svc-authelia-bind-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-svc-authelia-bind-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-svc-keycape-bind-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-svc-keycape-bind-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-svc-keycape-bind-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-svc-provisioner-bind-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-svc-provisioner-bind-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-svc-provisioner-bind-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "reuse-surface-eso" + ], + "bound_service_account_namespaces": [ + "reuse" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/forgejo-source-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "reuse-surface-runtime-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-reuse-surface-runtime-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_service_account_names": [ + "state-hub" + ], + "bound_service_account_namespaces": [ + "state-hub" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/forge-derivation", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/state-hub/forge-derivation", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "state-hub-forge-derivation", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-state-hub-forge-derivation" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "state-hub-preflight-eso" + ], + "bound_service_account_namespaces": [ + "state-hub" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "state-hub-rename-preflight-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-state-hub-rename-preflight" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "target-revenue-eso" + ], + "bound_service_account_namespaces": [ + "target-revenue" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/target-revenue/runtime-secrets", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "target-revenue-runtime-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-target-revenue-runtime-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "telemetry-grafana-eso" + ], + "bound_service_account_namespaces": [ + "telemetry" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/telemetry/grafana-admin", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "telemetry-grafana-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "telemetry-grafana-admin-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "telemetry-smtp-eso" + ], + "bound_service_account_namespaces": [ + "telemetry" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "telemetry-smtp-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "telemetry-smtp-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "tenant-engine-eso" + ], + "bound_service_account_namespaces": [ + "tenant-engine" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/tenant-engine/audit-core-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "tenant-engine-audit-core-sender-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-tenant-engine-audit-core-sender-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "user-engine" + ], + "bound_service_account_namespaces": [ + "user-engine" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/custody/net-kingdom/platform-root", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "user-engine-root-custody-reader", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 60, + "token_max_ttl_seconds": 60, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "user-engine-root-custody-reader" + ], + "token_ttl_seconds": 60, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "user-engine-scoped-mail-eso" + ], + "bound_service_account_namespaces": [ + "user-engine" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/callers/user-engine", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "user-engine-scoped-mail-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "email-connect-scoped-caller-reader" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "ttl_seconds": 900 + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "binky-company-email-imap-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-binky-company-email-imap" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "binky-qonto-api-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-binky-qonto-api" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "bound_audiences": [ + "codex-railiance-platform" + ], + "bound_claims": { + "principal_type": "service", + "roles": "coding-agent", + "sub": "service:codex:railiance-platform", + "tenant": "tenant:coulomb" + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/nk-bind-executor-approval", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/bounded-executor/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/nk-bind-executor-approval", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/bounded-executor/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "mount": "netkingdom", + "mount_type": "oidc", + "name": "coding-agent", + "role_type": "jwt", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 8, + "token_policies": [ + "agent-high-risk-boundary", + "workload-kv-read-issue-core-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "create", + "update" + ], + "path": "auth/token/create/keycape-client-secret-generate", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/lookup-accessor", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-accessor", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "credential-broker-keycape-client-secret-generate", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "credential-broker-keycape-client-secret-generate-issuer" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "fluid-telegram-operators" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "fluid-telegram-hall-of-helix-workload-kv", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 1800, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-fluid-telegram-hall-of-helix-operator" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "forgejo-admin-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-forgejo-admin" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "informed-decision-sitting-requester-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-informed-decision-sitting-requester-client" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "keycape-secrets-engine-openbao-operator-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-openbao-operator" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "claim_mappings": { + "/assurance/level": "assurance_level", + "email": "email", + "preferred_username": "username" + }, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "auth/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "cubbyhole/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "database/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "identity/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "list", + "read", + "update" + ], + "path": "operators/data/*", + "wildcard": true + }, + { + "capabilities": [ + "list", + "read" + ], + "path": "operators/metadata/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "pki/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "platform/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "reins/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "secret/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "ssh/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "sys/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "tenants/*", + "wildcard": true + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "platform-admin", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "platform-admin", + "operator-custody" + ], + "token_ttl_seconds": 3600, + "token_type": "default", + "ttl_seconds": 3600, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/policy-nexus/forgejo-source-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/policy-nexus/forgejo-source-read", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "policy-nexus-forgejo-source-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-policy-nexus-forgejo-source" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "railiance-backup-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-railiance-backup-offsite-lane" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "reuse-surface-hub-writers" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "reuse-surface-hub-writer-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 1800, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-reuse-surface-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "secrets-engine-approval-client-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-secrets-engine-approval-client" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "secrets-engine-requester-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-secrets-engine-requester-client" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "whynot-design" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "whynot-design-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-whynot-design-npm-publish" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + } + ] + }, + "schema": "railiance-platform.service-identity-metadata.v1", + "service": "openbao", + "source_kind": "live", + "value_safe": true +} diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/postgresql-identity-metadata-20261107.json b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/postgresql-identity-metadata-20261107.json new file mode 100644 index 0000000..1f53c0c --- /dev/null +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/postgresql-identity-metadata-20261107.json @@ -0,0 +1,97 @@ +{ + "collected_at": "2026-11-07T14:35:35Z", + "postgresql": { + "cluster": "net-kingdom-pg", + "databases": [ + { + "name": "interhub", + "owner": "interhub" + }, + { + "name": "postgres", + "owner": "postgres" + }, + { + "name": "privacyidea_db", + "owner": "privacyidea" + }, + { + "name": "probe", + "owner": "probe" + } + ], + "namespace": "databases", + "roles": [ + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "interhub", + "replication": false, + "superuser": false, + "valid_until": null + }, + { + "bypass_rls": true, + "can_login": true, + "connection_limit": -1, + "create_db": true, + "create_role": true, + "inherit": true, + "member_of": [], + "name": "postgres", + "replication": true, + "superuser": true, + "valid_until": null + }, + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "privacyidea", + "replication": false, + "superuser": false, + "valid_until": null + }, + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "probe", + "replication": false, + "superuser": false, + "valid_until": null + }, + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "streaming_replica", + "replication": true, + "superuser": false, + "valid_until": null + } + ], + "server_version": "16.13 (Debian 16.13-1.pgdg11+1)" + }, + "schema": "railiance-platform.service-identity-metadata.v1", + "service": "postgresql", + "source_kind": "live", + "value_safe": true +} diff --git a/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/report-20261107-rerun.json b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/report-20261107-rerun.json new file mode 100644 index 0000000..4efdf6f --- /dev/null +++ b/docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/report-20261107-rerun.json @@ -0,0 +1,217 @@ +{ + "as_of": "2026-11-07T14:40:00Z", + "freshness": [ + { + "age_hours": 0.1, + "collected_at": "2026-11-07T14:34:38Z", + "fresh": true, + "max_age_days": 7, + "service": "openbao", + "source_kind": "live" + }, + { + "age_hours": 0.1, + "collected_at": "2026-11-07T14:35:35Z", + "fresh": true, + "max_age_days": 7, + "service": "postgresql", + "source_kind": "live" + } + ], + "identities": [ + { + "evidence": "openbao", + "findings": [ + { + "detail": "netkingdom/platform-admin has no role max ttl; renewal is bounded by the mount/system default, which the export does not include", + "identity": "netkingdom-platform-admin", + "owner": "railiance-platform", + "rule": "lifetime", + "verdict": "unknown" + } + ], + "identity": "netkingdom-platform-admin", + "observed_as": [ + "netkingdom/platform-admin" + ], + "owner": "railiance-platform", + "service": "openbao", + "verdict": "unknown" + }, + { + "evidence": "openbao", + "findings": [], + "identity": "credential-broker-keycape-client-secret-generate", + "observed_as": [ + "netkingdom/credential-broker-keycape-client-secret-generate" + ], + "owner": "railiance-platform", + "service": "openbao", + "verdict": "conformant" + }, + { + "evidence": "openbao", + "findings": [], + "identity": "fluid-telegram-operators", + "observed_as": [ + "netkingdom/fluid-telegram-hall-of-helix-workload-kv" + ], + "owner": "railiance-platform", + "service": "openbao", + "verdict": "conformant" + }, + { + "evidence": "openbao", + "findings": [], + "identity": "secrets-engine-openbao", + "observed_as": [ + "keycape-services/secrets-engine-openbao" + ], + "owner": "railiance-platform", + "service": "openbao", + "verdict": "conformant" + }, + { + "evidence": "openbao", + "findings": [], + "identity": "coding-agent", + "observed_as": [ + "netkingdom/coding-agent", + "approle/coding-agent-railiance-platform" + ], + "owner": "railiance-platform", + "service": "openbao", + "verdict": "conformant" + }, + { + "evidence": "openbao", + "findings": [], + "identity": "net-kingdom-bounded-executor", + "observed_as": [ + "kubernetes/net-kingdom-bind-executor-svc-authelia-write" + ], + "owner": "railiance-platform (OpenBao role) for NetKingdom", + "service": "bounded-executor", + "verdict": "conformant" + }, + { + "evidence": "postgresql", + "findings": [], + "identity": "privacyidea", + "observed_as": [ + "net-kingdom-pg/privacyidea" + ], + "owner": "railiance-platform", + "service": "postgresql", + "verdict": "conformant" + } + ], + "summary": { + "conformant": 6, + "unknown": 1 + }, + "undeclared": [ + { + "detail": "undeclared role shares declared policies ['workload-kv-read-issue-core-runtime']", + "identity": "kubernetes/external-secrets-issue-core", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-company-email-imap'])", + "identity": "netkingdom/binky-company-email-imap-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-qonto-api'])", + "identity": "netkingdom/binky-qonto-api-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-forgejo-admin'])", + "identity": "netkingdom/forgejo-admin-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-informed-decision-sitting-requester-client'])", + "identity": "netkingdom/informed-decision-sitting-requester-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-policy-nexus-forgejo-source'])", + "identity": "netkingdom/policy-nexus-forgejo-source-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-railiance-backup-offsite-lane'])", + "identity": "netkingdom/railiance-backup-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-approval-client'])", + "identity": "netkingdom/secrets-engine-approval-client-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-requester-client'])", + "identity": "netkingdom/secrets-engine-requester-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared human OIDC role without aal2 (groups ['whynot-design'], policies ['workload-kv-read-whynot-design-npm-publish'])", + "identity": "netkingdom/whynot-design-workload-kv-read", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared login role (flags none, owns ['interhub'])", + "identity": "net-kingdom-pg/interhub", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared login role (flags ['superuser', 'create_role', 'create_db', 'replication', 'bypass_rls'], owns ['postgres'])", + "identity": "net-kingdom-pg/postgres", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared login role (flags none, owns ['probe'])", + "identity": "net-kingdom-pg/probe", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + }, + { + "detail": "undeclared login role (flags ['replication'], owns nothing)", + "identity": "net-kingdom-pg/streaming_replica", + "owner": "railiance-platform", + "rule": "SI-11", + "verdict": "unknown" + } + ], + "undeclared_summary": { + "non-conformant": 0, + "unknown": 14 + } +} diff --git a/tools/service-identity/observe.py b/tools/service-identity/observe.py index f8e3477..2d6c76c 100644 --- a/tools/service-identity/observe.py +++ b/tools/service-identity/observe.py @@ -57,7 +57,10 @@ OPENBAO_MAP: dict[tuple[str, str], list[dict[str, Any]]] = { "observe_only": True}], ("bounded-executor", "net-kingdom-bounded-executor"): [ {"mount": "kubernetes", "role": "net-kingdom-bind-executor-svc-authelia-write", - "service_account": ("sso", "nk-bind-executor")}], + "service_account": ("sso", "nk-bind-executor"), + # CCR-2026-0058 role_window: created per admitted window and deleted after the receipt; the window watch + # (CCR-2026-0064) alarms when it exists outside a run. Absent between runs is the conformant state. + "window_scoped": "CCR-2026-0058"}], } # Policies that make a role an administrator of OpenBao itself. @@ -84,6 +87,8 @@ def finding(identity: str, owner: str, verdict: str, rule: str, detail: str) -> def check_role(spec: dict, role: dict | None, declared: dict, ident: str, owner: str) -> list[dict]: where = f"{spec['mount']}/{spec['role']}" + if role is None and spec.get("window_scoped"): + return [] # absent between admitted runs, as declared; presence outside a run is the window watch's alarm if role is None: return [finding(ident, owner, "unknown", "observed", f"role {where} is not in the export (missing, or created after collected_at)")] diff --git a/tools/service-identity/tests/test_observe.py b/tools/service-identity/tests/test_observe.py index e5002ff..deaeba2 100644 --- a/tools/service-identity/tests/test_observe.py +++ b/tools/service-identity/tests/test_observe.py @@ -119,8 +119,14 @@ def test_agent_data_read_is_non_conformant(tmp_path): def test_missing_role_is_unknown(tmp_path): ob = openbao_doc() - ob["openbao"]["roles"].pop() - assert verdicts(run(tmp_path, ob=ob))["net-kingdom-bounded-executor"] == "unknown" + del ob["openbao"]["roles"][3] # secrets-engine-openbao + assert verdicts(run(tmp_path, ob=ob))["secrets-engine-openbao"] == "unknown" + + +def test_window_scoped_role_absent_between_runs_is_conformant(tmp_path): + ob = openbao_doc() + ob["openbao"]["roles"].pop() # net-kingdom-bind-executor-svc-authelia-write, CCR-2026-0058 + assert verdicts(run(tmp_path, ob=ob))["net-kingdom-bounded-executor"] == "conformant" def test_postgres_privilege_flag_and_undeclared_role(tmp_path): diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md index 23fac30..2d3f44c 100644 --- a/workplans/NK-WP-0054-service-identity-policy.md +++ b/workplans/NK-WP-0054-service-identity-policy.md @@ -195,7 +195,7 @@ status: wait priority: medium assignee: claude-code depends_on: [NK-WP-0054-T03] -blocking_reason: "First run 2026-11-07 (OpenBao, PostgreSQL); the keycape/platform-admin alias (admin login without aal2) was disabled by the founder the same day (receipt disabled_verified). Remaining: owner answers on that and the 14 undeclared roles, a fresh OpenBao export after the 2026-11-04 go-live, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed." +blocking_reason: "Rerun 2026-11-07 on a fresh export: 0 non-conformant (keycape alias disabled, confirmed). Open: railiance-platform answers on the platform-admin max TTL and 14 undeclared roles, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed." state_hub_task_id: "c8db4607-9306-572b-a3cb-c35ca5989ec7" ``` @@ -250,7 +250,10 @@ did not come from `auth/netkingdom`. railiance-platform removes the alias from i **2026-11-07 14:15Z: disabled.** Founder-run, receipt `disabled_verified` ([evidence](../docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md)): `keycape/` is gone, `netkingdom/` -remains, and the session survived. A fresh export will confirm it. +remains, and the session survived. **Confirmed by the 14:34Z fresh export:** the only role removed is +`keycape/platform-admin`. The rerun found 6 conformant and 1 unknown among declared identities, and 0 +non-conformant and 14 unknown among undeclared roles. The executor's write role is absent between runs, as +CCR-2026-0058 requires, and is now checked as window-scoped. ## Split the directory bind from the human admin