From 4021ca5e79d3f85197b26cc20d29c55771462cf1 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 16 Oct 2026 07:48:27 +0200 Subject: [PATCH] security: persist coding-agent denial of identity backup credentials Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- openbao/policies/agent-high-risk-boundary.hcl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbao/policies/agent-high-risk-boundary.hcl b/openbao/policies/agent-high-risk-boundary.hcl index 6f9775e..42251e7 100644 --- a/openbao/policies/agent-high-risk-boundary.hcl +++ b/openbao/policies/agent-high-risk-boundary.hcl @@ -153,3 +153,9 @@ path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" { path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" { capabilities = ["deny"] } path "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" { capabilities = ["deny"] } path "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" { capabilities = ["deny"] } + +# NK-WP-0049 / CCR-2026-0048 and0049: owner-only backup publisher/retention. +path "platform/data/workloads/net-kingdom/identity-backup/publisher" { capabilities = ["deny"] } +path "platform/metadata/workloads/net-kingdom/identity-backup/publisher" { capabilities = ["deny"] } +path "platform/data/workloads/net-kingdom/identity-backup/retention" { capabilities = ["deny"] } +path "platform/metadata/workloads/net-kingdom/identity-backup/retention" { capabilities = ["deny"] }