# Least-privilege read policy for the Forgejo operator/admin API token (PAT).
#
# Grants read access to the site-admin PAT used by workstation and activity-core
# automation (package prune, org webhooks, operator bootstrap). Sibling to
# forgejo-mailer (SMTP); no cluster ESO delivery in phase 1.

path "platform/data/workloads/forgejo/forgejo-admin" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/forgejo/forgejo-admin" {
  capabilities = ["read"]
}