environments:
  prod:
    backend: openbao-sealed-shamir
    real_values: generated-fresh-no-reuse
    unseal: shamir-3-of-5-break-glass

workloads:
  - id: rapp-qonto
    env_posture: prod
    maturity: M3

secret_requests:
  - secret: binky-qonto-api
    to_workload: rapp-qonto
    required_maturity: M3
    dataclass: restricted
  - secret: rapp-qonto-keycape-client
    to_workload: rapp-qonto
    required_maturity: M3
    dataclass: confidential