Broker audit-core dynamic database credentials

credential-grants/catalog.yaml

@@ -1,5 +1,5 @@
 version: 1
-updated: "2026-06-27"
+updated: "2026-08-10"
 owner_repo: railiance-platform
 owner_domain: financials
 workplan_id: RAILIANCE-WP-0005
@@ -24,6 +24,84 @@ grant_classes:
   - break-glass
 
 grants:
+  - id: rapp-postgres/audit-core-runtime
+    title: audit-core runtime PostgreSQL lease
+    status: active
+    grant_class: self-service
+    credential_type: openbao-database-credential
+    issuer: openbao
+    audience: audit-core
+    description: Short-lived runtime connection to the audit-core database.
+    openbao:
+      namespace: openbao
+      token_role: audit-core-runtime-broker
+      issuer_policy: credential-broker-audit-core-runtime-issuer
+      policies: [credential-broker-audit-core-runtime]
+      disallowed_policies: [root, platform-admin]
+      mount_paths: [database/creds/audit-core-runtime]
+    database:
+      role: audit-core-runtime
+      host: platform-pg-rw.databases.svc.cluster.local
+      port: 5432
+      name: audit_core
+      env: {PGUSER: username, PGPASSWORD: password, PGHOST: host, PGPORT: port, PGDATABASE: database}
+    ttl: {default: 15m, max: 1h, renewable: false, requires_human_above: 1h}
+    actors:
+      allowed_types: [human-operator, approved-agent, ci-runner]
+      required_subject_binding: keycape-or-kubernetes-service-account
+    authorization:
+      flex_auth_required: false
+      flex_auth_mode: optional-preflight
+      approval_required: false
+      purpose_required: true
+      allowed_purpose_examples: [audit-core-runtime]
+    delivery:
+      allowed: [exec-env]
+      preferred: exec-env
+      denied: [chat, state-hub-body, git, command-line-token-argument, llm-prompt]
+      exec_env: {child_only: true, redact_logs: true}
+    audit: {openbao_audit_required: true, state_hub_metadata_allowed: true, record_secret_values: false}
+    revocation: {required: true, by_accessor: true, on_exec_exit: true, on_denied_request: false}
+
+  - id: rapp-postgres/audit-core-migration
+    title: audit-core migration PostgreSQL lease
+    status: active
+    grant_class: self-service
+    credential_type: openbao-database-credential
+    issuer: openbao
+    audience: audit-core
+    description: Short-lived migration connection to the audit-core database.
+    openbao:
+      namespace: openbao
+      token_role: audit-core-migration-broker
+      issuer_policy: credential-broker-audit-core-migration-issuer
+      policies: [credential-broker-audit-core-migration]
+      disallowed_policies: [root, platform-admin]
+      mount_paths: [database/creds/audit-core-migration]
+    database:
+      role: audit-core-migration
+      host: platform-pg-rw.databases.svc.cluster.local
+      port: 5432
+      name: audit_core
+      env: {PGUSER: username, PGPASSWORD: password, PGHOST: host, PGPORT: port, PGDATABASE: database}
+    ttl: {default: 10m, max: 30m, renewable: false, requires_human_above: 30m}
+    actors:
+      allowed_types: [human-operator, approved-agent, ci-runner]
+      required_subject_binding: keycape-or-kubernetes-service-account
+    authorization:
+      flex_auth_required: false
+      flex_auth_mode: optional-preflight
+      approval_required: false
+      purpose_required: true
+      allowed_purpose_examples: [audit-core-migration]
+    delivery:
+      allowed: [exec-env]
+      preferred: exec-env
+      denied: [chat, state-hub-body, git, command-line-token-argument, llm-prompt]
+      exec_env: {child_only: true, redact_logs: true}
+    audit: {openbao_audit_required: true, state_hub_metadata_allowed: true, record_secret_values: false}
+    revocation: {required: true, by_accessor: true, on_exec_exit: true, on_denied_request: false}
+
   - id: ops-warden/warden-sign
     title: Ops Warden OpenBao SSH signing smoke token
     status: pilot