coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare scoped factory audit custody and enforce receiver compatibility

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-11 02:01:57 +02:00
parent d3a502b45c
commit bfe65a5b05
11 changed files with 1053 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
openbao/policies/agent-high-risk-boundary.hcl
View file

@ -129,3 +129,9 @@ path "platform/data/workloads/secrets-engine/approval-client" { capabilities = [
path "platform/data/workloads/approval-engine/operator-client" { capabilities = ["deny"] }
path "platform/metadata/workloads/secrets-engine/approval-client" { capabilities = ["deny"] }
path "platform/metadata/workloads/approval-engine/operator-client" { capabilities = ["deny"] }
# Proposed factory audit sender custody: CCR-2026-0021 / CCR-2026-0022.
path "platform/data/workloads/approval-engine/audit-sender" { capabilities = ["deny"] }
path "platform/metadata/workloads/approval-engine/audit-sender" { capabilities = ["deny"] }
path "platform/data/workloads/informed-decision/audit-sender" { capabilities = ["deny"] }
path "platform/metadata/workloads/informed-decision/audit-sender" { capabilities = ["deny"] }

3
openbao/policies/workload-kv-read-approval-engine-audit.hcl Normal file
View file

@ -0,0 +1,3 @@
path "platform/data/workloads/approval-engine/audit-sender" {
capabilities = ["read"]
}

3
openbao/policies/workload-kv-read-informed-decision-audit.hcl Normal file
View file

@ -0,0 +1,3 @@
path "platform/data/workloads/informed-decision/audit-sender" {
capabilities = ["read"]
}