railiance-platform/openbao/policies/workload-kv-read-keycape-secrets-engine-approval.hcl

path "platform/data/workloads/secrets-engine/approval-client" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/secrets-engine/approval-client" {
  capabilities = ["read"]
}
Admit KeyCape approval-engine client custody paths and delivery Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5 2026-09-08 14:53:32 +02:00			`path "platform/data/workloads/secrets-engine/approval-client" {`
			`capabilities = ["read"]`
			`}`

			`path "platform/metadata/workloads/secrets-engine/approval-client" {`
			`capabilities = ["read"]`
			`}`