From b0b6c0cf46efd2e12f604a6415abe61ffca11382 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 3 Nov 2026 21:19:54 +0100 Subject: [PATCH] Close RPF-WP-0067: value-safe OpenBao and PostgreSQL identity metadata for NK-WP-0054-T04. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4 --- WORK-RECORDS.md | 4 +- .../openbao-identity-metadata.json | 6724 +++++++++++++++++ .../postgresql-identity-metadata.json | 97 + ...m-identity-receipt-and-metadata-answers.md | 20 +- 4 files changed, 6840 insertions(+), 5 deletions(-) create mode 100644 docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/openbao-identity-metadata.json create mode 100644 docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/postgresql-identity-metadata.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index dc1721e..923a225 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -47,7 +47,7 @@ | workplan | RPF-WP-0064 | active | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | | workplan | RPF-WP-0065 | proposed | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | | workplan | RPF-WP-0066 | proposed | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md | -| workplan | RPF-WP-0067 | active | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | +| workplan | RPF-WP-0067 | finished | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | | workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md | | workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md | | workplan | RPF-WP-0070 | finished | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | @@ -228,7 +228,7 @@ | task | RPF-WP-0066-T06 | todo | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md | | task | RPF-WP-0067-T01 | done | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | | task | RPF-WP-0067-T02 | done | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | -| task | RPF-WP-0067-T03 | wait | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | +| task | RPF-WP-0067-T03 | done | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md | | task | RPF-WP-0068-T01 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md | | task | RPF-WP-0068-T02 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md | | task | RPF-WP-0068-T03 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md | diff --git a/docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/openbao-identity-metadata.json b/docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/openbao-identity-metadata.json new file mode 100644 index 0000000..45335ec --- /dev/null +++ b/docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/openbao-identity-metadata.json @@ -0,0 +1,6724 @@ +{ + "collected_at": "2026-11-03T20:18:53Z", + "openbao": { + "auth_mounts": [ + { + "path": "approle", + "type": "approle" + }, + { + "path": "keycape-services", + "type": "jwt" + }, + { + "path": "keycape", + "type": "oidc" + }, + { + "path": "kubernetes", + "type": "kubernetes" + }, + { + "path": "netkingdom", + "type": "oidc" + }, + { + "path": "token", + "type": "token" + } + ], + "policies": [ + { + "name": "agent-high-risk-boundary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/agent-harness/forgejo-deploy-key" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/operator-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/audit-core/senders" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/core-hub/runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/email-connect/transactional" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-privacyidea" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/scaleway/bootstrap" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/keycape-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/telemetry/grafana-admin" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/agent-harness/forgejo-deploy-key" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/email-connect/transactional" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/audit-sender" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-authelia" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-keycape" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-privacyidea" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-provisioner" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/publisher" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/retention" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/synthetic-journey/syn-journey" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/railiance-telemetry/smtp" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/scaleway/bootstrap" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/rapp-qonto/audit-sender" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/rapp-qonto/keycape-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/state-hub/repository-rename-preflight" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/telemetry/grafana-admin" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/company-email/imap" + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/qonto-api" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api" + } + ], + "sha256": "3a63bd8a05a053e19374b481a6185d4a17b92445a9155e3e43857c1e9f7cbb16" + }, + { + "name": "authelia-smtp-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + } + ], + "sha256": "023c502bb72453224d8ba05db75871289f69681e9ae6a8461504c867ef9c0e38" + }, + { + "name": "credential-broker-keycape-client-secret-generate-issuer", + "readable": true, + "rules": [ + { + "capabilities": [ + "create", + "update" + ], + "path": "auth/token/create/keycape-client-secret-generate" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/lookup-accessor" + }, + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-accessor" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + } + ], + "sha256": "a8579858f50f8385857ef1ec85f06c7f3e2378c64391b171a69a852836a84cd1" + }, + { + "name": "email-connect-platform-smtp-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + } + ], + "sha256": "023c502bb72453224d8ba05db75871289f69681e9ae6a8461504c867ef9c0e38" + }, + { + "name": "email-connect-scoped-caller-reader", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/callers/user-engine" + } + ], + "sha256": "cbc57e731c4fd9dbbaf98364de8ff87ed2966df18c2235cf298ffda963bf7553" + }, + { + "name": "external-secrets-audit-core", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-migration" + }, + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/audit-core/senders" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders" + } + ], + "sha256": "0d6afb577ab2f11af750c31664ac8d7a6e9082e5422caf7bb4bd22b053a62886" + }, + { + "name": "keycape-factor-renewer", + "readable": true, + "rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-issuer" + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read" + } + ], + "sha256": "606a7520c19314d13a69677be3fc8ed9c9251e54bd47f051d7137b596c59133a" + }, + { + "name": "net-kingdom-backup-publisher-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher" + } + ], + "sha256": "391e8164cef7661a4ff763c292cad45ebd37b112ade38412aa3e70f4b4156a8a" + }, + { + "name": "net-kingdom-backup-retention-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention" + } + ], + "sha256": "da4602c74911882b9ff7235a88df337a1f338f829fcfbe3f37418afdd09e79b2" + }, + { + "name": "net-kingdom-bind-executor-syn-journey-read", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" + } + ], + "sha256": "39b2fbd5fc796025b123edbc06dcb7983962eb69928890405d551198051cd550" + }, + { + "name": "net-kingdom-svc-authelia-bind-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia" + } + ], + "sha256": "144e65e7c840990bdbc0c879c4033b39d7a725a6079cfe5de854b7e51a312bc5" + }, + { + "name": "net-kingdom-svc-keycape-bind-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape" + } + ], + "sha256": "aa0254a1812655fc9e4abd872273fa4ee3617f3bdb676e4b1e8e59e1b0cdc477" + }, + { + "name": "net-kingdom-svc-provisioner-bind-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner" + } + ], + "sha256": "9e612343d19bb0352c47d4d0b0cd47d3e5b28e45957ffb3ff337613f19cde11e" + }, + { + "name": "operator-custody", + "readable": true, + "rules": [ + { + "capabilities": [ + "create", + "list", + "read", + "update" + ], + "path": "operators/data/*" + }, + { + "capabilities": [ + "list", + "read" + ], + "path": "operators/metadata/*" + } + ], + "sha256": "232210528936999dd57d95ccdb789e9e58f9915a6175048b1a3374c9e3c2dbe3" + }, + { + "name": "platform-admin", + "readable": true, + "rules": [ + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "auth/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "cubbyhole/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "database/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "identity/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "pki/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "platform/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "reins/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "secret/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "ssh/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "sys/*" + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "tenants/*" + } + ], + "sha256": "b015d66541c1a6034dc2e05d72158745f331f1b2c0994844fcd4bb8a2701432c" + }, + { + "name": "se-prod-activity-core-metered-worker-token", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01" + } + ], + "sha256": "c5c9e8167e6b87ad1d5fff3293a39e2a051b336a531bbce518347dee497f5dc6" + }, + { + "name": "se-prod-glas-claude-agent-dev-anthropic", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/glas-harness/claude-agent-dev" + } + ], + "sha256": "2428edb150f8649dd0321eca779a1dc5fa6f2ae8c401f3e7ec5ec026e2fd84fe" + }, + { + "name": "se-prod-openrouter-llm-connect", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + } + ], + "sha256": "fdebaee204fe488a2bd76a5f2d5b053f87b57dc0fac7b0d2fcd10dc443175849" + }, + { + "name": "se-prod-whynot-design-npm-publish", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "secret/data/coulomb/whynot-design/npm/publish" + }, + { + "capabilities": [ + "read" + ], + "path": "secret/metadata/coulomb/whynot-design/npm/publish" + } + ], + "sha256": "fa0e92a3531cff24aa3536763227527291ab7bd2f66624f9421251e8b7178dd8" + }, + { + "name": "secrets-engine-login-self", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao" + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/secrets-engine-openbao" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + } + ], + "sha256": "d1a2969dd2949c822972e9b32243650567ac123a669f3fc609e9bfea977bb4eb" + }, + { + "name": "telemetry-grafana-admin-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/telemetry/grafana-admin" + } + ], + "sha256": "6d74223aed2d4e8eef18e8adaef9b510952d3b09ca29cfa66e2d6a035d83f24e" + }, + { + "name": "telemetry-smtp-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp" + } + ], + "sha256": "023c502bb72453224d8ba05db75871289f69681e9ae6a8461504c867ef9c0e38" + }, + { + "name": "user-engine-root-custody-reader", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/custody/net-kingdom/platform-root" + } + ], + "sha256": "4a0403ff5d49c79d6787123d9854867f3e279ffbc48b68b56b613495ac137c15" + }, + { + "name": "warden-sign", + "readable": true, + "rules": [ + { + "capabilities": [ + "list", + "read" + ], + "path": "ssh/roles" + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/adm-role" + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/agt-role" + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/atm-role" + } + ], + "sha256": "84fc03e0465ce34b50693810be53da34305f59442c656309298b1cdfe16d1b4f" + }, + { + "name": "workload-kv-fluid-telegram-hall-of-helix-operator", + "readable": true, + "rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app" + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" + }, + { + "capabilities": [ + "create", + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt" + } + ], + "sha256": "5dfc0e60cdd657492bff30adb0bc52de5431b97c62dace70b8561aaae1b6dd75" + }, + { + "name": "workload-kv-read-activity-core-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-railiance01" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane" + } + ], + "sha256": "d75e33703a75b3872fb69d2a2350e765c8b4c8170ad0ed6a9af930d4add30169" + }, + { + "name": "workload-kv-read-approval-engine-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/audit-sender" + } + ], + "sha256": "a527c3bdfe7bf356fcd19f499ebc3ad75a71256a22c19882ad0dfdd09e0f0eb9" + }, + { + "name": "workload-kv-read-backup-object-storage", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/object-storage" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/object-storage" + } + ], + "sha256": "d33e9dbbb6dfcb547374acb9566388811f9228c84685dbaa1bbdf064eb8baf70" + }, + { + "name": "workload-kv-read-binky-company-email-imap", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/company-email/imap" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap" + } + ], + "sha256": "af8f475f07fcf187abc6ea208883b9c9050af045e0a5f37bf80fd5d113cdea11" + }, + { + "name": "workload-kv-read-binky-qonto-api", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/qonto-api" + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api" + } + ], + "sha256": "c80f7495e7a829c9370808ed569dab521f4f75ac1062a8ca82eece74d8e39133" + }, + { + "name": "workload-kv-read-core-hub-forgejo-source", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/forgejo-source-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/forgejo-source-read" + } + ], + "sha256": "2fc858d3c2801924bdf28640fd3fecf0267e8814b6bec2f4be1b97b6ad46304f" + }, + { + "name": "workload-kv-read-core-hub-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime" + } + ], + "sha256": "375328abc3a0c6edb62d2c950f3a1cad99f42b3fd793a807f706fd27ffcd0d64" + }, + { + "name": "workload-kv-read-coulomb-social-backup-primary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb-social/backup-primary" + } + ], + "sha256": "1d4a570b04e28dcd54e443a25e98a3a4e163fee6b50760984eb657512c880b90" + }, + { + "name": "workload-kv-read-email-connect-backup-primary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/backup-primary" + } + ], + "sha256": "8ba281e1a5bce9db210d9b807a328cc6c083fa38e0e63eaff1ffad5cd64018f4" + }, + { + "name": "workload-kv-read-email-connect-transactional-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/transactional" + } + ], + "sha256": "ebcdcc1f6bb175ab7557b0de996cf5733af4d621ceefdbd81a4b918090fe2094" + }, + { + "name": "workload-kv-read-forgejo-admin", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin" + } + ], + "sha256": "574551b7358a5363081db3a0c62984e0ea6632fa887e502aafaf7c7b9eac070e" + }, + { + "name": "workload-kv-read-forgejo-mailer-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-mailer" + } + ], + "sha256": "5375172552accb42d2465ea4a6e81548ed5108dae77de5a64227fc4cd065faa7" + }, + { + "name": "workload-kv-read-inbound-library-imap", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/inbound-library/imap" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/inbound-library/imap" + } + ], + "sha256": "cc93bbe0029880f9b1404708270b0f50bd2e54bfcf3e32491a7e32fb43c0cb8c" + }, + { + "name": "workload-kv-read-informed-decision-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/audit-sender" + } + ], + "sha256": "389e952546d32692e87b4f249752a9bee0fafa9fc58bf50ab8904110bf6b3780" + }, + { + "name": "workload-kv-read-informed-decision-sitting-requester-client", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester" + } + ], + "sha256": "87427b0c0247897eb04d4c15284787cee05e5c2fb257998e7f62aee9ed7c66c8" + }, + { + "name": "workload-kv-read-informed-decision-sitting-requester-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + } + ], + "sha256": "b892e40f2b5a08d1c0fe71dac69147067ee21405ef74bf3bf7c4ef4849838f2c" + }, + { + "name": "workload-kv-read-issue-core-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" + } + ], + "sha256": "54b9f864f3435910143a860352aac5ecb3aa2cd7afb5e161bb304c12d821c55e" + }, + { + "name": "workload-kv-read-keycape-approval-engine-operator", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/operator-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client" + } + ], + "sha256": "97957b44511280012eb789e10c00810b546558bb2b9f3a5b212ced1a76d49203" + }, + { + "name": "workload-kv-read-keycape-factor-read", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/net-kingdom/keycape-factor-read" + } + ], + "sha256": "ba89842196d5aac00d12dcfda7342292f1ea789b71b59daf0aa16f925d53e1ab" + }, + { + "name": "workload-kv-read-keycape-forgejo-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/forgejo" + } + ], + "sha256": "f1d6752e3ecb16fac49f88b1d91ecc355021bf2e73e1184c0980822378b8f5d8" + }, + { + "name": "workload-kv-read-keycape-informed-decision-sitting-requester", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester" + } + ], + "sha256": "87427b0c0247897eb04d4c15284787cee05e5c2fb257998e7f62aee9ed7c66c8" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-approval", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client" + } + ], + "sha256": "3898d04168f100738d53a7bfb33973b65ef6d68fc1012e23abb45eee8d923f81" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-openbao-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao" + } + ], + "sha256": "55a2b04d3158bc67bd2f8f8f23ff98885af0c35091f4f49a99cdc4638c438af2" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-openbao-operator", + "readable": true, + "rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao" + } + ], + "sha256": "82034d000739f7daaba0b0a106b5cb2ea280e788bbde728190f197b121b5bf2c" + }, + { + "name": "workload-kv-read-keycape-secrets-engine-requester", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester" + } + ], + "sha256": "1524b768403283a9d684ba29191ea3941827090285897de0b23b8e66176331d0" + }, + { + "name": "workload-kv-read-llm-connect-provider-secrets", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" + } + ], + "sha256": "4aea84e882c8c677bbf007a78aa528c6a8d9ffb40d01eab574b72fc8ae26f2f1" + }, + { + "name": "workload-kv-read-mas-backup-primary", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/mas/backup-primary" + } + ], + "sha256": "d2505ffbe2da3158107114f3b232a0cd81d75d63a4c367047ec39311b81500f0" + }, + { + "name": "workload-kv-read-mas-tem-relay", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/suppliers/scaleway/mas-tem-relay" + } + ], + "sha256": "88267821db36083045f6827702d4bb8e5e71675ea2bab9f9e9a4d198f18865bf" + }, + { + "name": "workload-kv-read-policy-nexus-forgejo-source", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/policy-nexus/forgejo-source-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/policy-nexus/forgejo-source-read" + } + ], + "sha256": "ccef3f352633ccc19396b85635401357b0b2e6282aed8238b378791985831806" + }, + { + "name": "workload-kv-read-railiance-backup-offsite-lane", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane" + } + ], + "sha256": "299df57a813bac92b17e49253cf4492b8582b4ec81791e72a44c26f21262ec83" + }, + { + "name": "workload-kv-read-rapp-qonto-audit", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender" + } + ], + "sha256": "2d17cd763c9c36a7fb7110121d30c2e53731d04482412d6f99f98cfe52af3c0c" + }, + { + "name": "workload-kv-read-rein-openweights-openrouter", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "reins/data/rein-openweights/openrouter" + }, + { + "capabilities": [ + "read" + ], + "path": "reins/metadata/rein-openweights/openrouter" + } + ], + "sha256": "76df5b622d3a4634159d92166c221432c8d6a0de55e03c13e0e2a4f028c1f7b9" + }, + { + "name": "workload-kv-read-reuse-surface-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self" + } + ], + "sha256": "53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257" + }, + { + "name": "workload-kv-read-reuse-surface-runtime-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets" + } + ], + "sha256": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b" + }, + { + "name": "workload-kv-read-secrets-engine-approval-client", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client" + } + ], + "sha256": "3898d04168f100738d53a7bfb33973b65ef6d68fc1012e23abb45eee8d923f81" + }, + { + "name": "workload-kv-read-secrets-engine-requester-client", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester" + } + ], + "sha256": "1524b768403283a9d684ba29191ea3941827090285897de0b23b8e66176331d0" + }, + { + "name": "workload-kv-read-state-hub-forge-derivation", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/forge-derivation" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/state-hub/forge-derivation" + } + ], + "sha256": "514ea0ef31bf1ac32040a72f9cb79be400d09520610b0e06dc411408337d1647" + }, + { + "name": "workload-kv-read-state-hub-rename-preflight", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight" + } + ], + "sha256": "73aba7ffb93e58fe0dd32b9bed3eadf065561453526ad14474f2c5f3ea0edcb7" + }, + { + "name": "workload-kv-read-target-revenue-runtime-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/target-revenue/runtime-secrets" + } + ], + "sha256": "a118ba4111ed695a8c2fb5c9f0920bc473ca3ee5d02897c906632202d34d57f6" + }, + { + "name": "workload-kv-read-tenant-engine-audit-core-sender-eso", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self" + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/tenant-engine/audit-core-sender" + } + ], + "sha256": "b9e06bae80fbfd18dfa3279ed9bb8b7fcf4b5fdcad76fbc509fbbb5e99c86b53" + }, + { + "name": "workload-kv-read-user-engine-runtime", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/user-engine/runtime" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/user-engine/runtime" + } + ], + "sha256": "2180f09deb36691d59da9f0703a57124f8f185c26b5f45a1317718e543875f2a" + }, + { + "name": "workload-kv-read-whynot-design-npm-publish", + "readable": true, + "rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish" + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish" + } + ], + "sha256": "5d627c71ffa7c9a6f2ba881623a354bdcb73aacf06b92017c7553ce9e0e21457" + } + ], + "roles": [ + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "agent-harness-binky-mail", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-binky-company-email-imap" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "coding-agent-railiance-platform", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 300, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 8, + "token_policies": [ + "agent-high-risk-boundary", + "workload-kv-read-issue-core-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-migration", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "database/creds/audit-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-audit-core", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 7200, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "external-secrets-audit-core" + ], + "token_ttl_seconds": 3600, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/object-storage", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/object-storage", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-backup-object-storage", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-backup-object-storage" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-rapp-qonto", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-binky-qonto-api" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/user-engine/runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/user-engine/runtime", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-sso-user-engine", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-user-engine-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/user-engine/runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/user-engine/runtime", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "external-secrets-user-engine", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-user-engine-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/inbound-library/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/inbound-library/imap", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "inbound-library", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-inbound-library-imap" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "reins/data/rein-openweights/openrouter", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "reins/metadata/rein-openweights/openrouter", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "rein-openweights", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "workload-kv-read-rein-openweights-openrouter" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-activity-core-metered-worker-token", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 300, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "se-prod-activity-core-metered-worker-token" + ], + "token_ttl_seconds": 300, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/glas-harness/claude-agent-dev", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-glas-claude-agent-dev-anthropic", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 300, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "se-prod-glas-claude-agent-dev-anthropic" + ], + "token_ttl_seconds": 300, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-openrouter-llm-connect", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 900, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 8, + "token_policies": [ + "se-prod-openrouter-llm-connect" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "secret/data/coulomb/whynot-design/npm/publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "secret/metadata/coulomb/whynot-design/npm/publish", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "se-prod-whynot-design-npm-publish", + "role_type": "approle", + "secret_id_num_uses": 0, + "secret_id_ttl_seconds": 0, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "se-prod-whynot-design-npm-publish" + ], + "token_ttl_seconds": 1800, + "token_type": "default" + }, + { + "bind_secret_id": true, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "list", + "read" + ], + "path": "ssh/roles", + "wildcard": false + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/adm-role", + "wildcard": false + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/agt-role", + "wildcard": false + }, + { + "capabilities": [ + "create", + "update" + ], + "path": "ssh/sign/atm-role", + "wildcard": false + } + ], + "mount": "approle", + "mount_type": "approle", + "name": "warden-sign", + "role_type": "approle", + "secret_id_num_uses": 1, + "secret_id_ttl_seconds": 1800, + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "warden-sign" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_audiences": [ + "secrets-engine-openbao" + ], + "bound_claims": { + "principal_type": "service", + "roles": "secrets-engine", + "scope": "openbao:login", + "tenant": "tenant:platform" + }, + "bound_claims_type": "string", + "bound_subject": "service:secrets-engine", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/keycape/secrets-engine-openbao", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "mount": "keycape-services", + "mount_type": "jwt", + "name": "secrets-engine-openbao", + "role_type": "jwt", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 8, + "token_policies": [ + "secrets-engine-login-self" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "claim_mappings": { + "email": "email", + "preferred_username": "username" + }, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "auth/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "cubbyhole/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "database/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "identity/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "pki/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "platform/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "reins/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "secret/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "ssh/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "sys/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "tenants/*", + "wildcard": true + } + ], + "groups_claim": "groups", + "mount": "keycape", + "mount_type": "oidc", + "name": "platform-admin", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "platform-admin" + ], + "token_ttl_seconds": 3600, + "token_type": "default", + "ttl_seconds": 3600, + "user_claim": "sub" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "activity-core-eso" + ], + "bound_service_account_namespaces": [ + "activity-core" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-railiance01", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "activity-core-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-activity-core-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "authelia-smtp-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "authelia-smtp-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "authelia-smtp-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "backup-primary-delivery" + ], + "bound_service_account_namespaces": [ + "coulomb-social" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb-social/backup-primary", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "coulomb-social-backup-primary-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-coulomb-social-backup-primary" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "backup-primary-delivery" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/backup-primary", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-backup-primary-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-email-connect-backup-primary" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "email-connect-platform-smtp-eso" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-platform-smtp-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "email-connect-platform-smtp-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "email-connect-scoped-caller-eso" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/callers/user-engine", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-scoped-caller-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "email-connect-scoped-caller-reader" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "email-connect-eso" + ], + "bound_service_account_namespaces": [ + "email-connect" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/transactional", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "email-connect-transactional-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-email-connect-transactional-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-activity-core", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-llm-connect-provider-secrets" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-approval-engine-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-approval-engine-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/forgejo-source-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/forgejo-source-read", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-core-hub-forgejo-source", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-core-hub-forgejo-source" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-core-hub-runtime", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-core-hub-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-informed-decision-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-informed-decision-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-issue-core", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-issue-core-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-approval-engine-operator", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-approval-engine-operator" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/forgejo", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-forgejo", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-forgejo-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-informed-decision-sitting-requester", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-informed-decision-sitting-requester" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-secrets-engine-approval", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-approval" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-secrets-engine-openbao", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-openbao-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-keycape-secrets-engine-requester", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-requester" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "mas-tem-relay-eso" + ], + "bound_service_account_namespaces": [ + "mas" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/suppliers/scaleway/mas-tem-relay", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-mas-tem-relay", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-mas-tem-relay" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-rapp-qonto-audit", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-rapp-qonto-audit" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "bound_service_account_names": [ + "external-secrets" + ], + "bound_service_account_namespaces": [ + "external-secrets" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "external-secrets-reuse-surface", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-reuse-surface-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "forgejo-mailer-eso" + ], + "bound_service_account_namespaces": [ + "forgejo" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-mailer", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "forgejo-mailer-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-forgejo-mailer-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "informed-decision-eso" + ], + "bound_service_account_namespaces": [ + "informed-decision" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "informed-decision-sitting-requester-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-informed-decision-sitting-requester-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "keycape-factor-renewer" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-issuer", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "keycape-factor-renewer", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "keycape-factor-renewer" + ], + "token_ttl_seconds": 300, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "keycape-factor-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/keycape-factor-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/net-kingdom/keycape-factor-read", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "keycape-factor-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-keycape-factor-read" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "backup-primary-delivery" + ], + "bound_service_account_namespaces": [ + "mas" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/mas/backup-primary", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "mas-backup-primary-workload-kv-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-mas-backup-primary" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-backup-publisher-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-backup-publisher-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-backup-publisher-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-backup-retention-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-backup-retention-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-backup-retention-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "nk-bind-executor" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-bind-executor-syn-journey-read", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-bind-executor-syn-journey-read" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-svc-authelia-bind-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-svc-authelia-bind-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-svc-authelia-bind-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-svc-keycape-bind-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-svc-keycape-bind-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-svc-keycape-bind-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "net-kingdom-svc-provisioner-bind-eso" + ], + "bound_service_account_namespaces": [ + "sso" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "net-kingdom-svc-provisioner-bind-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "net-kingdom-svc-provisioner-bind-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "reuse-surface-eso" + ], + "bound_service_account_namespaces": [ + "reuse" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/forgejo-source-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "reuse-surface-runtime-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-reuse-surface-runtime-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "bound_service_account_names": [ + "state-hub" + ], + "bound_service_account_namespaces": [ + "state-hub" + ], + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/forge-derivation", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/state-hub/forge-derivation", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "state-hub-forge-derivation", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-state-hub-forge-derivation" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "state-hub-preflight-eso" + ], + "bound_service_account_namespaces": [ + "state-hub" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "state-hub-rename-preflight-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-state-hub-rename-preflight" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900 + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "target-revenue-eso" + ], + "bound_service_account_namespaces": [ + "target-revenue" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/target-revenue/runtime-secrets", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "target-revenue-runtime-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-target-revenue-runtime-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "telemetry-grafana-eso" + ], + "bound_service_account_namespaces": [ + "telemetry" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/telemetry/grafana-admin", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "telemetry-grafana-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "telemetry-grafana-admin-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "telemetry-smtp-eso" + ], + "bound_service_account_namespaces": [ + "telemetry" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "telemetry-smtp-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "telemetry-smtp-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "tenant-engine-eso" + ], + "bound_service_account_namespaces": [ + "tenant-engine" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/tenant-engine/audit-core-sender", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "tenant-engine-audit-core-sender-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-tenant-engine-audit-core-sender-eso" + ], + "token_ttl_seconds": 900, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "user-engine" + ], + "bound_service_account_namespaces": [ + "user-engine" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/custody/net-kingdom/platform-root", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "user-engine-root-custody-reader", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 60, + "token_max_ttl_seconds": 60, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "user-engine-root-custody-reader" + ], + "token_ttl_seconds": 60, + "token_type": "default" + }, + { + "audience": "openbao", + "bound_service_account_names": [ + "user-engine-scoped-mail-eso" + ], + "bound_service_account_namespaces": [ + "user-engine" + ], + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/email-connect/callers/user-engine", + "wildcard": false + } + ], + "mount": "kubernetes", + "mount_type": "kubernetes", + "name": "user-engine-scoped-mail-eso", + "role_type": "kubernetes", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "email-connect-scoped-caller-reader" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "ttl_seconds": 900 + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "binky-company-email-imap-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-binky-company-email-imap" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "binky-qonto-api-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-binky-qonto-api" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "bound_audiences": [ + "codex-railiance-platform" + ], + "bound_claims": { + "principal_type": "service", + "roles": "coding-agent", + "sub": "service:codex:railiance-platform", + "tenant": "tenant:coulomb" + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/data/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/agent-harness/forgejo-deploy-key", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/approval-engine/operator-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/audit-core/senders", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/core-hub/runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/email-connect/transactional", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-authelia", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-keycape", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-privacyidea", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/directory-binds/svc-provisioner", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/publisher", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/identity-backup/retention", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/net-kingdom/synthetic-journey/syn-journey", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/railiance-telemetry/smtp", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/scaleway/bootstrap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/rapp-qonto/audit-sender", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/rapp-qonto/keycape-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/state-hub/repository-rename-preflight", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "platform/metadata/workloads/telemetry/grafana-admin", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "deny" + ], + "path": "tenants/data/binky/qonto-api", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/company-email/imap", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "tenants/metadata/binky/qonto-api", + "wildcard": false + } + ], + "mount": "netkingdom", + "mount_type": "oidc", + "name": "coding-agent", + "role_type": "jwt", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 8, + "token_policies": [ + "agent-high-risk-boundary", + "workload-kv-read-issue-core-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "create", + "update" + ], + "path": "auth/token/create/keycape-client-secret-generate", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/lookup-accessor", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-accessor", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "credential-broker-keycape-client-secret-generate", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 900, + "token_max_ttl_seconds": 900, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "credential-broker-keycape-client-secret-generate-issuer" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "fluid-telegram-operators" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read", + "update" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session", + "wildcard": false + }, + { + "capabilities": [ + "create", + "read" + ], + "path": "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "fluid-telegram-hall-of-helix-workload-kv", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 1800, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-fluid-telegram-hall-of-helix-operator" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/forgejo/forgejo-admin", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/forgejo/forgejo-admin", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "forgejo-admin-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-forgejo-admin" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/informed-decision/sitting-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/informed-decision/sitting-requester", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "informed-decision-sitting-requester-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-informed-decision-sitting-requester-client" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/keycape/secrets-engine-openbao", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "keycape-secrets-engine-openbao-operator-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 300, + "token_max_ttl_seconds": 300, + "token_no_default_policy": true, + "token_num_uses": 4, + "token_policies": [ + "workload-kv-read-keycape-secrets-engine-openbao-operator" + ], + "token_ttl_seconds": 300, + "token_type": "service", + "ttl_seconds": 300, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "claim_mappings": { + "/assurance/level": "assurance_level", + "email": "email", + "preferred_username": "username" + }, + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "auth/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "cubbyhole/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "database/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "identity/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "list", + "read", + "update" + ], + "path": "operators/data/*", + "wildcard": true + }, + { + "capabilities": [ + "list", + "read" + ], + "path": "operators/metadata/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "pki/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "platform/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "reins/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "secret/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "ssh/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "sudo", + "update" + ], + "path": "sys/*", + "wildcard": true + }, + { + "capabilities": [ + "create", + "delete", + "list", + "read", + "update" + ], + "path": "tenants/*", + "wildcard": true + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "platform-admin", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "platform-admin", + "operator-custody" + ], + "token_ttl_seconds": 3600, + "token_type": "default", + "ttl_seconds": 3600, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/policy-nexus/forgejo-source-read", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/policy-nexus/forgejo-source-read", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "policy-nexus-forgejo-source-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-policy-nexus-forgejo-source" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/railiance/backup/offsite-lane", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/railiance/backup/offsite-lane", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "railiance-backup-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-railiance-backup-offsite-lane" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback", + "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback" + ], + "bound_claims": { + "/assurance/level": "aal2", + "groups": [ + "reuse-surface-hub-writers" + ] + }, + "bound_claims_type": "string", + "effective_complete": true, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "auth/token/lookup-self", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "auth/token/revoke-self", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets", + "wildcard": false + }, + { + "capabilities": [ + "update" + ], + "path": "sys/capabilities-self", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "reuse-surface-hub-writer-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 1800, + "token_max_ttl_seconds": 1800, + "token_no_default_policy": true, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-reuse-surface-runtime" + ], + "token_ttl_seconds": 900, + "token_type": "service", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-client", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-client", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "secrets-engine-approval-client-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-secrets-engine-approval-client" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "net-kingdom-admins" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/secrets-engine/approval-requester", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/secrets-engine/approval-requester", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "secrets-engine-requester-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-secrets-engine-requester-client" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + }, + { + "allowed_redirect_uris": [ + "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback", + "http://localhost:8250/oidc/callback", + "http://127.0.0.1:8250/oidc/callback" + ], + "bound_claims": { + "groups": [ + "whynot-design" + ] + }, + "bound_claims_type": "string", + "effective_complete": false, + "effective_rules": [ + { + "capabilities": [ + "read" + ], + "path": "platform/data/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + }, + { + "capabilities": [ + "read" + ], + "path": "platform/metadata/workloads/coulomb/whynot-design/npm-publish", + "wildcard": false + } + ], + "groups_claim": "groups", + "mount": "netkingdom", + "mount_type": "oidc", + "name": "whynot-design-workload-kv-read", + "oidc_scopes": [ + "openid", + "profile", + "email", + "groups" + ], + "role_type": "oidc", + "token_explicit_max_ttl_seconds": 0, + "token_max_ttl_seconds": 0, + "token_no_default_policy": false, + "token_num_uses": 0, + "token_policies": [ + "workload-kv-read-whynot-design-npm-publish" + ], + "token_ttl_seconds": 900, + "token_type": "default", + "ttl_seconds": 900, + "user_claim": "sub" + } + ] + }, + "schema": "railiance-platform.service-identity-metadata.v1", + "service": "openbao", + "source_kind": "live", + "value_safe": true +} diff --git a/docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/postgresql-identity-metadata.json b/docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/postgresql-identity-metadata.json new file mode 100644 index 0000000..5258d67 --- /dev/null +++ b/docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/postgresql-identity-metadata.json @@ -0,0 +1,97 @@ +{ + "collected_at": "2026-11-03T20:18:54Z", + "postgresql": { + "cluster": "net-kingdom-pg", + "databases": [ + { + "name": "interhub", + "owner": "interhub" + }, + { + "name": "postgres", + "owner": "postgres" + }, + { + "name": "privacyidea_db", + "owner": "privacyidea" + }, + { + "name": "probe", + "owner": "probe" + } + ], + "namespace": "databases", + "roles": [ + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "interhub", + "replication": false, + "superuser": false, + "valid_until": null + }, + { + "bypass_rls": true, + "can_login": true, + "connection_limit": -1, + "create_db": true, + "create_role": true, + "inherit": true, + "member_of": [], + "name": "postgres", + "replication": true, + "superuser": true, + "valid_until": null + }, + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "privacyidea", + "replication": false, + "superuser": false, + "valid_until": null + }, + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "probe", + "replication": false, + "superuser": false, + "valid_until": null + }, + { + "bypass_rls": false, + "can_login": true, + "connection_limit": -1, + "create_db": false, + "create_role": false, + "inherit": true, + "member_of": [], + "name": "streaming_replica", + "replication": true, + "superuser": false, + "valid_until": null + } + ], + "server_version": "16.13 (Debian 16.13-1.pgdg11+1)" + }, + "schema": "railiance-platform.service-identity-metadata.v1", + "service": "postgresql", + "source_kind": "live", + "value_safe": true +} diff --git a/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md b/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md index ddbe0e7..4863402 100644 --- a/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md +++ b/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md @@ -4,7 +4,7 @@ type: workplan title: "NetKingdom owner answers: execution-attribution receipt emitter and service-identity metadata export" domain: financials repo: railiance-platform -status: active +status: finished flavor: implementation owner: claude created: "2026-10-28" @@ -124,9 +124,8 @@ Proven from source for net-kingdom `tools/service-identity/declarations/openbao. ```task id: RPF-WP-0067-T03 -status: wait +status: done priority: medium -blocking_reason: "Live read-only export needs the founder's OpenBao platform-admin login and cluster access." state_hub_task_id: "23ea4894-120a-556e-bf24-4b01cb2ddcfb" ``` @@ -154,3 +153,18 @@ python3 scripts/service_identity_metadata_export.py postgresql-sql \ Exit 0 writes the file; exit 3 means a secret-shaped value was found and nothing was written; exit 2 is a read failure. Return both JSON files to NetKingdom; they hold no secret values. + +**Live export run 2026-11-03.** The founder ran both exports at 21:18 +(workstation time) using the contained `openbao-platform-admin-login` and the +attended admin kubeconfig. Both exited 0. +- OpenBao: 6 auth mounts, 67 policies, 73 roles. +- PostgreSQL `net-kingdom-pg` 16.13: 5 roles (`interhub`, `postgres`, + `privacyidea`, `probe`, `streaming_replica`), 4 databases. +A scan for secret-shaped values (Vault tokens, PEM, SCRAM/md5 hashes, JWTs) +found none, and no Secret was read. Files: +`docs/evidence/2026-11-03-nk-wp-0054-t04-identity-metadata/` +- `openbao-identity-metadata.json`, sha256 `60da6df0…aa1b` +- `postgresql-identity-metadata.json`, sha256 `e627278b…541a` +They were sent to NetKingdom as a reply to brief `f5d366f5`. T03 is done, and +RPF-WP-0067 is finished. T01's open items belong to the runner owners, +NetKingdom and audit-core.