# Ephemeral read policy for WH-ENG-20260822-AUDIT-E2-02.
#
# The External Secrets Operator may read exactly two per-engagement values.
# It cannot read the audit-core sender registry, the expired -01 engagement,
# or any other engagement path.

path "platform/data/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-a" {
  capabilities = ["read"]
}

path "platform/metadata/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-a" {
  capabilities = ["read"]
}

path "platform/data/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-b" {
  capabilities = ["read"]
}

path "platform/metadata/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-b" {
  capabilities = ["read"]
}