From 7d7260ffa338f2eb002f952bc2a97170f1e39758 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 17 Jul 2026 00:31:09 +0200
Subject: [PATCH] openbao: grant platform-admin access to tenants/ mount

WARDEN-WP-0028 added mount tenants/ for client secrets; platform-admin
only covered platform/* and secret/*, so UI operators could not see
binky paths. Add tenants/* CRUD+list.
---
 openbao/policies/platform-admin.hcl | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/openbao/policies/platform-admin.hcl b/openbao/policies/platform-admin.hcl
index 1fc7c77..27db5a2 100644
--- a/openbao/policies/platform-admin.hcl
+++ b/openbao/policies/platform-admin.hcl
@@ -39,3 +39,9 @@ path "cubbyhole/*" {
 path "secret/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
 }
+
+# Client/tenant commercial secrets (WARDEN-WP-0028). Separate mount from
+# platform/workloads so tenant lanes are not mixed with fleet service secrets.
+path "tenants/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}