16 lines
663 B
HCL
16 lines
663 B
HCL
|
# Least-privilege read policy for the qonto-assistant workload access lane.
|
||
|
|
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
|
||
|
|
# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
|
||
|
|
# Second, workload-scoped lane onto the same value CCR-2026-0008 vends to the
|
||
|
|
# human/OIDC admin lane; see CCR-2026-0009. Kubernetes auth subject is
|
||
|
|
# external-secrets/external-secrets, ClusterSecretStore scoped to the
|
||
|
|
# qonto-assistant namespace only. Read-only; no secret writes from this lane.
|
||
|
|
|
||
|
|
path "tenants/data/binky/qonto-api" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "tenants/metadata/binky/qonto-api" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|