# Exact-path JWT delivery; no issuer password or sibling paths.
path "platform/data/workloads/net-kingdom/keycape-factor-read" {
  capabilities = ["read"]
}
path "platform/metadata/workloads/net-kingdom/keycape-factor-read" {
  capabilities = ["read"]
}

# ESO validates its own short-lived workload session.
path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "auth/token/revoke-self" {
  capabilities = ["update"]
}