tegwick 8dbf62515a Show the OpenBao identity warden access evaluates ... reuse-surface-hub-write-token does not select a caller. The data plane uses the ambient token, which can be the coding-agent role denied by agent-high-risk-boundary while an attended platform-admin lookup still shows read. Advisory and proxy output now report that entity, role, and policies without the token. CCR-2026-0005 still has no OIDC binding for workload-kv-read-reuse-surface-runtime. Assistant: grok Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0		2026-10-14 18:21:02 +02:00
..
catalog.yaml	Show the OpenBao identity warden access evaluates	2026-10-14 18:21:02 +02:00