Finding from the inbound-library lane (ILIB-WP-0003): the build grant can
write a policy, bind it to an AppRole and mint a secret-id, yielding a
token outside its own denies. Options recorded for founder decision; the
policy is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1170398@bnt-lap001
Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
