# Least-privilege read policy for the Railiance offsite backup lane (Option A).
#
# Grants read access to Nextcloud WebDAV upload credentials and age recovery
# escrow used by railiance-backup / forgejo-backup on operator workstations.
# No write, list, or sibling-workload capabilities.

path "platform/data/workloads/railiance/backup/offsite-lane" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/railiance/backup/offsite-lane" {
  capabilities = ["read"]
}