# Least-privilege read policy for agent-harness Forgejo deploy key.
# Private key is held on the worker host; OpenBao holds a recovery/copy.
# Exact path only — no list on parent, no sibling workload paths.

path "platform/data/workloads/agent-harness/forgejo-deploy-key" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/agent-harness/forgejo-deploy-key" {
  capabilities = ["read"]
}