coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0008 active: tenants/binky/qonto-api lane live
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Align path and fields (API_KEY, API_USER) with provisioned secret; policy and
OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.
This commit is contained in:
tegwick 2026-07-21 21:42:10 +02:00
parent 9f452f25be
commit 1cbaac7a73
4 changed files with 71 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

9
openbao/policies/workload-kv-read-binky-qonto-api.hcl
View file

@ -1,12 +1,13 @@
# Least-privilege read policy for Binky Qonto bank API credentials.
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
# Exact path only; no list on parent, no sibling tenant paths.
# Used by self-hosted qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.
# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
# Consumers map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
# qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.
path "tenants/data/binky/qonto/api" {
path "tenants/data/binky/qonto-api" {
capabilities = ["read"]
}
path "tenants/metadata/binky/qonto/api" {
path "tenants/metadata/binky/qonto-api" {
capabilities = ["read"]
}