Show the OpenBao identity warden access evaluates

reuse-surface-hub-write-token does not select a caller. The data plane
uses the ambient token, which can be the coding-agent role denied by
agent-high-risk-boundary while an attended platform-admin lookup still
shows read. Advisory and proxy output now report that entity, role, and
policies without the token. CCR-2026-0005 still has no OIDC binding for
workload-kv-read-reuse-surface-runtime.

Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0

tests/test_access.py

@@ -93,6 +93,31 @@ def test_operator_subject_does_not_override_legacy_agent_marker():
 
 # --- CLI -------------------------------------------------------------------
 
+def test_access_advisory_shows_ambient_openbao_caller(monkeypatch):
+    monkeypatch.setenv("WARDEN_ROUTING_CATALOG", str(_repo_catalog()))
+
+    def described(env=None, **kwargs):
+        return {
+            "source": "BAO_TOKEN",
+            "entity_id": "4a1f663c-0621-0483-edd0-f852274f4b6b",
+            "display_name": "platform-root",
+            "auth_path": "auth/netkingdom/oidc/callback",
+            "policies": ["agent-high-risk-boundary"],
+            "oidc_role": "coding-agent",
+            "ttl": 900,
+            "error": None,
+        }
+
+    monkeypatch.setattr("warden.openbao_caller.describe_ambient_openbao_caller", described)
+    r = runner.invoke(app, ["access", "reuse-surface hub write token", "--json"])
+    assert r.exit_code == 0
+    payload = json.loads(r.stdout)
+    caller = payload["openbao_caller"]
+    assert caller["entity_id"] == "4a1f663c-0621-0483-edd0-f852274f4b6b"
+    assert "agent-high-risk-boundary" in caller["boundary_note"]
+    assert "id" not in caller
+
+
 def test_access_advisory_output(monkeypatch):
     monkeypatch.setenv("WARDEN_ROUTING_CATALOG", str(_repo_catalog()))
     r = runner.invoke(app, ["access", "npm token", "--domain", "coulomb_social"])