# Full platform-operator policy for the initial OpenBao bootstrap phase.
#
# Use only for trusted S3 platform operators. This is intentionally broad so
# the root token can be retired after bootstrap. Prefer narrower workload
# policies for application access.

path "sys/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

path "auth/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

path "identity/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "platform/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "database/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "pki/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "ssh/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "cubbyhole/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "secret/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Client/tenant commercial secrets (WARDEN-WP-0028). Separate mount from
# platform/workloads so tenant lanes are not mixed with fleet service secrets.
path "tenants/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# reins/ -- per-rein credential secrets (glas-harness family), mount added
# 2026-07-27 by ops-mason (MASON-WP-0001-T05). Added here so platform-admin
# can complete paste-once-provision into any rein's path, matching every
# other KV mount already listed in this policy.
path "reins/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}