Read-only inventory from manifests and files, no Secrets read. The admin credential
has five consumers (human, Authelia, KeyCape, the privacyIDEA resolver and the
identity-provisioner), so the bind split needs svc-authelia, svc-keycape,
svc-privacyidea and a scoped provisioner account. Unknowns and who confirms them
are listed. trigger-admin recorded as an uninventoried legacy admin.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
