Show the OpenBao identity warden access evaluates

reuse-surface-hub-write-token does not select a caller. The data plane
uses the ambient token, which can be the coding-agent role denied by
agent-high-risk-boundary while an attended platform-admin lookup still
shows read. Advisory and proxy output now report that entity, role, and
policies without the token. CCR-2026-0005 still has no OIDC binding for
workload-kv-read-reuse-surface-runtime.

Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0

src/warden/cli.py

@@ -1172,6 +1172,41 @@ def route_find(
 # warden access — operator front door (advisory; proxy lands in T3)
 # ---------------------------------------------------------------------------
 
+def _openbao_caller_view(entry) -> Optional[dict]:
+    """Sanitized data-plane identity. Absent for lanes that do not use it."""
+    if entry.warden_executes or entry.lane == "login" or not entry.exec_capable:
+        return None
+    from warden.openbao_caller import caller_boundary_note, describe_ambient_openbao_caller
+
+    described = describe_ambient_openbao_caller()
+    note = caller_boundary_note(described, high_risk=bool(entry.is_high_risk))
+    if note:
+        described = {**described, "boundary_note": note}
+    return described
+
+
+def _print_openbao_caller(entry) -> None:
+    described = _openbao_caller_view(entry)
+    if described is None:
+        return
+    if described.get("error"):
+        console.print(
+            f"  openbao  : [yellow]{described['source']}[/yellow] — {described['error']}"
+        )
+        return
+    policies = ", ".join(described.get("policies") or []) or "(none)"
+    role = described.get("oidc_role") or "(none)"
+    console.print(
+        f"  openbao  : {described['source']}  entity {described.get('entity_id') or '(none)'}"
+    )
+    console.print(f"  role     : {role}   policies: {policies}")
+    if described.get("boundary_note"):
+        console.print(f"  caller   : [yellow]{described['boundary_note']}[/yellow]")
+    console.print(
+        "  gate id  : [dim]flex-auth uses policy.caller_auth, not this OpenBao entity[/dim]"
+    )
+
+
 def _access_json(entry, expanded, gate: str, domain: Optional[str]) -> dict:
     """Stable, secret-free JSON shape for agentic operators. WP-0014 T2."""
     payload = _entry_summary(entry)
@@ -1184,6 +1219,9 @@ def _access_json(entry, expanded, gate: str, domain: Optional[str]) -> dict:
         "policy_ref": expanded.policy_ref,
         "exec_capable": expanded.exec_capable,
     }
+    caller = _openbao_caller_view(entry)
+    if caller is not None:
+        payload["openbao_caller"] = caller
     if entry.warden_executes:
         payload["next_action"] = "ops-warden issues this directly — see cert_command"
         payload["cert_command"] = entry.cert_command
@@ -1372,6 +1410,25 @@ def _access_proxy(
             )
             raise typer.Exit(6)
 
+    # After the refusals above, so a denied gate does not look like a fetch.
+    # The lookup uses the OpenBao CLI and must not run on those paths.
+    if not is_login:
+        caller = _openbao_caller_view(entry)
+        if caller is not None:
+            if caller.get("error"):
+                err.print(
+                    f"[yellow]OpenBao caller:[/yellow] {caller['source']} — {caller['error']}"
+                )
+            else:
+                err.print(
+                    "[dim]OpenBao caller[/dim] "
+                    f"{caller['source']} entity {caller.get('entity_id') or '(none)'} "
+                    f"role {caller.get('oidc_role') or '(none)'} "
+                    f"policies {', '.join(caller.get('policies') or []) or '(none)'}"
+                )
+            if caller.get("boundary_note"):
+                err.print(f"[yellow]{caller['boundary_note']}[/yellow]")
+
     action = "login" if is_login else ("exec" if do_exec else "fetch")
     err.print(
         f"[dim]proxy {action}: {entry.id} → {entry.owner_repo} "
@@ -1566,6 +1623,7 @@ def access(
 
     if expanded.auth_method:
         console.print(f"  auth     : {expanded.auth_method}")
+    _print_openbao_caller(entry)
     if expanded.path_template:
         console.print(f"  path     : {expanded.path_template}")
     if expanded.fetch_command and entry.lane != "login":