tegwick
9f452f25be
Policy + OIDC role for tenants/binky/qonto/api; agent-high-risk-boundary deny on data path. Implements DEC-2026-004 / BINKY-WP-0005 custody; secret values remain founder Red-lane.
12 lines
440 B
HCL
12 lines
440 B
HCL
# Least-privilege read policy for Binky Qonto bank API credentials.
|
|
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
|
|
# Exact path only; no list on parent, no sibling tenant paths.
|
|
# Used by self-hosted qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.
|
|
|
|
path "tenants/data/binky/qonto/api" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "tenants/metadata/binky/qonto/api" {
|
|
capabilities = ["read"]
|
|
}
|