railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl

path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
  capabilities = ["read"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "auth/token/revoke-self" {
  capabilities = ["update"]
}

# CCR-2026-0046 proposed; exact extra data path, no metadata/list grants.
path "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" {
  capabilities = ["read"]
}