6f77484785
CCR-2026-0043 applied cleanly, but generate could not mint the grant token (OpenBao refuses child tokens from a limited-use token; the role had token_num_uses 8) and revoke-self was denied (missing from the issuer policy). The role now uses 0, which the validator requires, and the issuer policy grants revoke-self. Nothing was written by the probe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
20 lines
588 B
HCL
20 lines
588 B
HCL
# CCR-2026-0040 (RPF-WP-0054): the credential broker may mint keycape/client-secret-generate
|
|
# tokens only through this token role. Bind to the reviewed caller identity only.
|
|
path "auth/token/create/keycape-client-secret-generate" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
path "auth/token/lookup-accessor" {
|
|
capabilities = ["update"]
|
|
}
|
|
path "auth/token/revoke-accessor" {
|
|
capabilities = ["update"]
|
|
}
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|
|
path "sys/capabilities-self" {
|
|
capabilities = ["update"]
|
|
}
|