diff --git a/openbao/policies/platform-admin.hcl b/openbao/policies/platform-admin.hcl
index 1fc7c77..27db5a2 100644
--- a/openbao/policies/platform-admin.hcl
+++ b/openbao/policies/platform-admin.hcl
@@ -39,3 +39,9 @@ path "cubbyhole/*" {
 path "secret/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
 }
+
+# Client/tenant commercial secrets (WARDEN-WP-0028). Separate mount from
+# platform/workloads so tenant lanes are not mixed with fleet service secrets.
+path "tenants/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}