# Non-production metadata applier for reviewed credential changes.
#
# This policy is intended for build/test/staging OpenBao lanes after a
# non-production mount or namespace is declared. It intentionally keeps the same
# no-secret-value rule as production; generated test secrets still require a
# separately approved non-production value path.

# Workload KV read-lane policies generated from approved CCRs.
path "sys/policies/acl/workload-kv-read-*" {
  capabilities = ["create", "update", "read"]
}

# Credential broker issuer policies generated from approved grant metadata.
path "sys/policies/acl/credential-broker-*-issuer" {
  capabilities = ["create", "update", "read"]
}

# OIDC roles for caller-scoped workload KV lanes. The local applier
# dry-run constrains role names and bound claims per CCR.
path "auth/netkingdom/role/*" {
  capabilities = ["create", "update", "read"]
}

# Kubernetes roles for in-cluster workload and provider-secret lanes.
path "auth/kubernetes/role/*" {
  capabilities = ["create", "update", "read"]
}

# Token roles for approved credential-broker child-token issuers.
path "auth/token/roles/credential-broker-*" {
  capabilities = ["create", "update", "read"]
}

# Self-checks and capability introspection only.
path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "sys/capabilities-self" {
  capabilities = ["update"]
}