# Least-privilege read policy for the qonto-assistant workload access lane.
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
# Second, workload-scoped lane onto the same value CCR-2026-0008 vends to the
# human/OIDC admin lane; see CCR-2026-0009. Kubernetes auth subject is
# external-secrets/external-secrets, ClusterSecretStore scoped to the
# qonto-assistant namespace only. Read-only; no secret writes from this lane.

path "tenants/data/binky/qonto-api" {
  capabilities = ["read"]
}

path "tenants/metadata/binky/qonto-api" {
  capabilities = ["read"]
}