# Least-privilege read policy for Binky Qonto bank API credentials.
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
# Consumers map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
# qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.

path "tenants/data/binky/qonto-api" {
  capabilities = ["read"]
}

path "tenants/metadata/binky/qonto-api" {
  capabilities = ["read"]
}