# Metadata-only example. Copy outside Git for an attended approved rotation.
approved: false
approved_by: "operator-name"
approved_at: "2026-08-23T00:00:00Z"
changes:
  - path: secrets/hetzner-token.yaml
    before_recipients:
      - age1old-example-not-valid
    after_recipients:
      - age1new-example-not-valid