Allow bounded ESO token self-validation and cleanup

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
2026-09-05 16:47:26 +02:00 · 2026-09-05 16:47:26 +02:00 · 9c86983f1a
commit 9c86983f1a
parent 238d261536
5 changed files with 29 additions and 2 deletions
--- a/openbao/policies/workload-kv-read-state-hub-rename-preflight.hcl
+++ b/openbao/policies/workload-kv-read-state-hub-rename-preflight.hcl
@ -1,3 +1,11 @@
 path "platform/data/workloads/state-hub/repository-rename-preflight" {
  capabilities = ["read"]
 }
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}