Dedicated ServiceAccount sso/nk-agent-status (SI-14), read-only Jobs/pods/Deployments/ExternalSecrets in
sso, one named ConfigMap in informed-decision and one Argo Application; no Secrets, logs or exec. Options
A-D for the founder decision; tests keep the grant narrow and sso workloads free of literal secrets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0