railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl
codex a570bc2f5b Prepare restricted seven-source reuse reader and bounded recovery
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
2026-10-15 01:25:46 +02:00

16 lines
397 B
HCL

path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
capabilities = ["read"]
}
path "auth/token/lookup-self" {
capabilities = ["read"]
}
path "auth/token/revoke-self" {
capabilities = ["update"]
}
# CCR-2026-0046 proposed; exact extra data path, no metadata/list grants.
path "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" {
capabilities = ["read"]
}