6858bef858
Review of net-kingdom's proposed SecurityCaseType oidc-service-client 0.1 (hub message 4ec57765): mint grant covers the keycape/<client_id> family but the broker does not admit the type yet (R1); consumer role shape consistent (R2); ESO bodies, consumer role name and rotation text need a type r2 (R3-R5, R7); per-case CCRs required (R6), drafted for nk-bind-executor-approval. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
15 lines
489 B
HCL
15 lines
489 B
HCL
# workload-kv-read-keycape-nk-bind-executor-approval-eso: CCR-2026-0060 (proposed), SecurityCase
|
|
# nk-bind-executor-approval (oidc-service-client@0.1, proposed). Platform-generated from the CCR
|
|
# (token_self_lifecycle true, as CCR-2026-0041). Source only; not applied.
|
|
|
|
path "platform/data/workloads/keycape/nk-bind-executor-approval" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|