Approve Policy Nexus source credential lane

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
2026-08-31 23:03:48 +02:00 · 2026-08-31 23:03:48 +02:00 · 2a44d2eced
commit 2a44d2eced
parent 361005cf0c
3 changed files with 111 additions and 66 deletions
--- a/openbao/policies/agent-high-risk-boundary.hcl
+++ b/openbao/policies/agent-high-risk-boundary.hcl
@ -100,3 +100,10 @@ path "auth/token/lookup-self" {
 path "auth/token/revoke-self" {
  capabilities = ["update"]
 }
+path "platform/data/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["deny"]
+}
+
+path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["deny"]
+}
--- a/openbao/policies/workload-kv-read-policy-nexus-forgejo-source.hcl
+++ b/openbao/policies/workload-kv-read-policy-nexus-forgejo-source.hcl
@ -0,0 +1,7 @@
+path "platform/data/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["read"]
+}