# Least-privilege policy for External Secrets Operator Forgejo mailer lane.
#
# The matching Kubernetes auth role binds only the ESO service account in the
# external-secrets namespace. ClusterSecretStore usage is separately limited to
# the forgejo namespace.

path "platform/data/workloads/forgejo/*" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/forgejo/*" {
  capabilities = ["read", "list"]
}