railiance-platform/openbao/policies/inputs/ops-warden-high-risk-data-paths.yaml
codex 429cc912ed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Finish coding-agent high-risk boundary coverage
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
2026-08-22 10:03:54 +02:00

90 lines
3.8 KiB
YAML

# GENERATED by ops-warden/scripts/emit_high_risk_paths.py -- do not edit by hand.
# Vendored policy input. ops-warden owns the risk grade; railiance-platform owns
# whether and how agent-high-risk-boundary denies each path.
generated_at: "2026-08-21T11:28:33Z"
source: ops-warden/registry/routing/catalog.yaml
catalog_revision: "55f0f47a021375b8b25c924953d1b49a24e002c5"
catalog_revision_date: "2026-08-21T13:26:10+02:00"
catalog_dirty: false
high_risk_lane_count: 19
concrete_path_count: 14
no_concrete_path:
- database-dynamic-credentials
- inter-hub-bootstrap-ssh
- object-storage-sts
- openbao-api-key
- ops-warden-warden-sign-token
paths:
- id: agent-harness-binky-mail-approle
data_path: tenants/data/binky/company-email/imap
metadata_path: tenants/metadata/binky/company-email/imap
owner_repo: railiance-platform
fields: null
- id: agent-harness-forgejo-deploy
data_path: platform/data/workloads/agent-harness/forgejo-deploy-key
metadata_path: platform/metadata/workloads/agent-harness/forgejo-deploy-key
owner_repo: railiance-platform
fields: null
- id: audit-core-senders
data_path: platform/data/workloads/audit-core/senders
metadata_path: platform/metadata/workloads/audit-core/senders
owner_repo: ops-mason
fields: null
- id: binky-company-email-imap
data_path: tenants/data/binky/company-email/imap
metadata_path: tenants/metadata/binky/company-email/imap
owner_repo: railiance-platform
fields: null
- id: binky-qonto-api
data_path: tenants/data/binky/qonto-api
metadata_path: tenants/metadata/binky/qonto-api
owner_repo: railiance-platform
fields: null
- id: email-connect-transactional
data_path: platform/data/workloads/email-connect/transactional
metadata_path: platform/metadata/workloads/email-connect/transactional
owner_repo: railiance-platform
fields: null
- id: forgejo-admin-api-token
data_path: platform/data/workloads/forgejo/forgejo-admin
metadata_path: platform/metadata/workloads/forgejo/forgejo-admin
owner_repo: railiance-platform
fields: null
- id: issue-core-ingestion-api-key
data_path: platform/data/workloads/issue-core/issue-core/issue-core-runtime
metadata_path: platform/metadata/workloads/issue-core/issue-core/issue-core-runtime
owner_repo: railiance-platform
fields: [ISSUE_CORE_API_KEY, GITEA_BACKEND_TOKEN]
- id: openrouter-llm-connect
data_path: platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets
metadata_path: platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets
owner_repo: railiance-platform
fields: null
- id: railiance-backup-offsite-lane
data_path: platform/data/workloads/railiance/backup/offsite-lane
metadata_path: platform/metadata/workloads/railiance/backup/offsite-lane
owner_repo: railiance-platform
fields: null
- id: rapp-qonto-keycape-client
data_path: platform/data/workloads/rapp-qonto/keycape-client
metadata_path: platform/metadata/workloads/rapp-qonto/keycape-client
owner_repo: key-cape
fields: null
- id: reuse-surface-hub-write-token
data_path: platform/data/workloads/reuse/reuse-surface/runtime-secrets
metadata_path: platform/metadata/workloads/reuse/reuse-surface/runtime-secrets
owner_repo: railiance-platform
fields: [REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET]
- id: scaleway-bootstrap
data_path: platform/data/workloads/railiance/scaleway/bootstrap
metadata_path: platform/metadata/workloads/railiance/scaleway/bootstrap
owner_repo: railiance-platform
fields: null
- id: whynot-design-npm-publish
data_path: platform/data/workloads/coulomb/whynot-design/npm-publish
metadata_path: platform/metadata/workloads/coulomb/whynot-design/npm-publish
owner_repo: railiance-platform
fields: null