From 53e91ab2d2eae1a47be32b1d393057b0321ab96f Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 7 Oct 2026 02:08:40 +0200
Subject: [PATCH] Propose token self-lifecycle for the CCR-2026-0033 ESO reader

ESO validates a store with auth/token/lookup-self, and the role drops the
default policy, so the applied store failed with 403. Adds lookup-self and
revoke-self on the reader's own token, as in CCR-2026-0005 and the
keycape-factor-read lane. Needs founder approval before re-apply.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
---
 credential-change-requests/CCR-2026-0033.yaml            | 1 +
 ...rkload-kv-read-keycape-secrets-engine-openbao-eso.hcl | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/credential-change-requests/CCR-2026-0033.yaml b/credential-change-requests/CCR-2026-0033.yaml
index 7f317d8..bc6723c 100644
--- a/credential-change-requests/CCR-2026-0033.yaml
+++ b/credential-change-requests/CCR-2026-0033.yaml
@@ -61,6 +61,7 @@ openbao:
   policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
   policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
   metadata_read: false
+  token_self_lifecycle: true
   auth:
     method: kubernetes
     mount: kubernetes
diff --git a/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl b/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
index b07a283..64df36f 100644
--- a/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
+++ b/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
@@ -1,3 +1,12 @@
 path "platform/data/workloads/keycape/secrets-engine-openbao" {
   capabilities = ["read"]
 }
+
+# ESO validates its own short-lived workload session.
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}