# Least-privilege read policy for Binky Qonto bank API credentials.
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
# Exact path only; no list on parent, no sibling tenant paths.
# Used by self-hosted qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.

path "tenants/data/binky/qonto/api" {
  capabilities = ["read"]
}

path "tenants/metadata/binky/qonto/api" {
  capabilities = ["read"]
}