schema_version: 1
lane_id: example-workload-kv
ccr_id: CCR-2099-9001
title: Synthetic exact workload KV read fixture
date: '2026-10-04'
consumer_repo: example-consumer
owner_repo: railiance-platform
requester:
  agent: example-consumer
  reason: Offline fixture only; no deployed consumer or credential exists
review_approvers:
- platform-owner
- consumer-owner
target:
  domain: infotech
  tenant: platform
  workload: example-consumer
  environment: build
  purpose: Offline fixture of proposed exact-path metadata
openbao:
  mount: platform
  kv_path: platform/workloads/example-consumer/config
  fields:
  - CLIENT_SECRET
  policy_name: workload-kv-read-example-consumer
  auth:
    mount: kubernetes
    role: example-consumer-eso
    audience: openbao
    service_account_names:
    - example-consumer-eso
    service_account_namespaces:
    - example-consumer
    ttl: 15m
eso:
  store_name: openbao-example-consumer
  server: http://openbao.openbao.svc:8200
  namespace: example-consumer
  external_secret_name: example-consumer-config
  secret_name: example-consumer-config
  refresh_interval: 5m
  data:
  - secret_key: client-secret
    property: CLIENT_SECRET
risk:
  classification: standard
  notes:
  - Synthetic prospective lane risk applies to the entire readable path; no actual
    credentials.