railiance-platform/openbao/auth/coding-agent-jwt-role.json
codex 2126457a16 RPF-WP-0065: coding-agent accepts service+agent transitionally; platform-admin binds aal2 (source only, NK-WP-0054)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2026-10-24 23:49:27 +02:00

23 lines
557 B
JSON

{
"role_type": "jwt",
"bound_audiences": [
"codex-railiance-platform"
],
"user_claim": "sub",
"bound_claims_type": "string",
"bound_claims": {
"sub": "service:codex:railiance-platform",
"principal_type": ["service", "agent"],
"tenant": "tenant:platform",
"roles": "coding-agent"
},
"token_policies": [
"agent-high-risk-boundary",
"workload-kv-read-issue-core-runtime"
],
"token_ttl": "15m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_no_default_policy": true,
"verbose_oidc_logging": false
}