coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0008: Binky Qonto API tenant lane (approved, pending apply)

Browse source 
Policy + OIDC role for tenants/binky/qonto/api; agent-high-risk-boundary
deny on data path. Implements DEC-2026-004 / BINKY-WP-0005 custody; secret
values remain founder Red-lane.
This commit is contained in:
tegwick 2026-07-21 21:26:25 +02:00
parent 30a6833943
commit 9f452f25be
4 changed files with 149 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
openbao/policies/workload-kv-read-binky-qonto-api.hcl Normal file
View file

@ -0,0 +1,12 @@
# Least-privilege read policy for Binky Qonto bank API credentials.
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
# Exact path only; no list on parent, no sibling tenant paths.
# Used by self-hosted qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.
path "tenants/data/binky/qonto/api" {
capabilities = ["read"]
}
path "tenants/metadata/binky/qonto/api" {
capabilities = ["read"]
}