schema_version: 1
lane_id: informed-decision-sitting-requester-eso
ccr_id: CCR-2026-0032
title: Informed Decision create-only requester workload read
date: '2026-10-04'
consumer_repo: informed-decision
owner_repo: railiance-platform
requester:
  agent: informed-decision
  reason: INFD-WP-0005-T05 request cd811073; prepare workload delivery of existing requester custody
review_approvers:
- platform-owner
- informed-decision-owner
target:
  domain: financials
  tenant: platform
  workload: informed-decision
  environment: production
  purpose: Deliver existing create-only requester client to the review pod through namespace-restricted ESO
openbao:
  mount: platform
  kv_path: platform/workloads/informed-decision/sitting-requester
  fields:
  - CLIENT_SECRET
  policy_name: workload-kv-read-informed-decision-sitting-requester-eso
  auth:
    mount: kubernetes
    role: informed-decision-sitting-requester-eso
    audience: openbao
    service_account_names:
    - informed-decision-eso
    service_account_namespaces:
    - informed-decision
    ttl: 15m
eso:
  store_name: openbao-informed-decision-sitting-requester
  server: http://openbao.openbao.svc:8200
  namespace: informed-decision
  external_secret_name: informed-decision-sitting-requester
  secret_name: informed-decision-sitting-requester
  refresh_interval: 5m
  data:
  - secret_key: client-secret
    property: CLIENT_SECRET
risk:
  classification: high
  notes:
  - The whole KV path is readable; the existing CLIENT_SECRET permits approval:create for subject informed-decision
  - Any ExternalSecret in the informed-decision namespace can reference this store; no other namespace is admitted
  - No approval:approve, approval:consume, sibling read, metadata listing or new client is granted