coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0008: Binky Qonto API tenant lane (approved, pending apply)

Browse source 
Policy + OIDC role for tenants/binky/qonto/api; agent-high-risk-boundary
deny on data path. Implements DEC-2026-004 / BINKY-WP-0005 custody; secret
values remain founder Red-lane.
This commit is contained in:
tegwick 2026-07-21 21:26:25 +02:00
parent 30a6833943
commit 9f452f25be
4 changed files with 149 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/workload-kv-access-lanes.md
View file

@ -397,6 +397,32 @@ warden access binky-company-email-imap --all --out /tmp/p # preferred
Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.
### Binky Qonto bank API (`CCR-2026-0008`)
| Item | Value |
| --- | --- |
| ops-warden catalog id | `binky-qonto-api` |
| Tenant | `binky` |
| Mount | `tenants` |
| OpenBao CLI path | `tenants/binky/qonto/api` |
| Fields | `QONTO_API_KEY`, `QONTO_ORGANIZATION_ID` |
| Read policy | `workload-kv-read-binky-qonto-api` |
| Policy file | `openbao/policies/workload-kv-read-binky-qonto-api.hcl` |
| OIDC role | `binky-qonto-api-workload-kv-read` |
| Front-door readiness | draft until founder Red provision (DEC-2026-004 / BINKY-WP-0005-T05) |
| Risk | high |
| Consumer | self-hosted `qonto/qonto-mcp-server`; harness read-only tool allow-list |
```bash
bao login -method=oidc -path=netkingdom role=binky-qonto-api-workload-kv-read
# after provision:
warden access binky-qonto-api --all --exec -- \
env | grep -E '^QONTO_' | sed 's/=.*/=<redacted>/' # lengths only in normal ops
```
Design: `binky-control/integrations/qonto-mcp.md`.
Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.
## agent-harness Forgejo deploy key
| Item | Value |