coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close CCR drift and high-risk policy gaps
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-21 01:29:28 +02:00
parent 852a8ab661
commit 382f04412a
12 changed files with 577 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

36
openbao/policies/agent-high-risk-boundary.hcl
View file

@ -28,6 +28,42 @@ path "platform/data/workloads/core-hub/runtime" {
path "platform/metadata/workloads/core-hub/runtime" {
capabilities = ["read"]
}
path "platform/data/workloads/coulomb/whynot-design/npm-publish" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/coulomb/whynot-design/npm-publish" {
capabilities = ["read"]
}
path "platform/data/workloads/rapp-qonto/keycape-client" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/rapp-qonto/keycape-client" {
capabilities = ["read"]
}
path "platform/data/workloads/agent-harness/forgejo-deploy-key" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/agent-harness/forgejo-deploy-key" {
capabilities = ["read"]
}
path "platform/data/workloads/audit-core/senders" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/audit-core/senders" {
capabilities = ["read"]
}
path "platform/data/workloads/email-connect/transactional" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/email-connect/transactional" {
capabilities = ["read"]
}
path "platform/data/workloads/railiance/scaleway/bootstrap" {
capabilities = ["deny"]
}
path "platform/metadata/workloads/railiance/scaleway/bootstrap" {
capabilities = ["read"]
}
# --- tenant high-risk (WARDEN-WP-0028) ---
path "tenants/data/binky/company-email/imap" {