# Least-privilege policy for the External Secrets Operator email-connect lane.
#
# The matching Kubernetes auth role binds only the ESO service account in the
# external-secrets namespace. ClusterSecretStore usage is separately limited to
# the email-connect namespace.

path "platform/data/workloads/email-connect/transactional" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/email-connect/transactional" {
  capabilities = ["read"]
}