coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0007: binky IMAP on tenants/ mount + CCR allowlist
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Enable tenant commercial secrets: applier accepts mount tenants/, apply
policy and OIDC role for company-email IMAP (metadata only; values are
founder Red provision). Extend agent-high-risk-boundary for the path.
This commit is contained in:
tegwick 2026-07-17 00:09:28 +02:00
parent 347226eb36
commit 86209fa90c
6 changed files with 218 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

11
openbao/policies/workload-kv-read-binky-company-email-imap.hcl Normal file
View file

@ -0,0 +1,11 @@
# Least-privilege read policy for Binky company email IMAP credentials.
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
# Exact path only; no list on parent, no sibling tenant paths.
path "tenants/data/binky/company-email/imap" {
capabilities = ["read"]
}
path "tenants/metadata/binky/company-email/imap" {
capabilities = ["read"]
}