3fbb610d1f
Answers the-custodian 641673a4. An attended read-only check (receipt docs/evidence/2026-09-23-openbao-platform-admin-check.json) found: - live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27); repo now matches live (sha256 0ca5b821...). No live write. - role also attaches operator-custody (undeclared); declared here. - role declared as openbao/auth/netkingdom-platform-admin-role.json. - default policy is attached and grants revoke-self/lookup-self, so the suspected missing grant is not the cause of warden's unconfirmed revocation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
30 lines
1.4 KiB
HCL
30 lines
1.4 KiB
HCL
# operator-custody — human operators' own credentials.
|
|
#
|
|
# Distinct from platform-admin on purpose. platform-admin lists the mounts an
|
|
# administrator operates *on*; this is the one mount an administrator keeps
|
|
# things *in*. Separating them means custody can move independently of
|
|
# administration — which is exactly what the S6 trust stage (two-of-three
|
|
# independent recovery control) requires, and it cannot be done later if the
|
|
# grant is buried inside platform-admin.
|
|
#
|
|
# Holds: service account passwords, provider PATs, LLDAP admin bind,
|
|
# privacyIDEA pi-admin, machine identities. See
|
|
# net-kingdom/docs/platform-root-custody.md, "Operator Credential Custody".
|
|
#
|
|
# Does NOT hold, and must never: platform-root's own password, unseal shares,
|
|
# the break-glass password. Those live in the offline packet — putting them
|
|
# here is a circular dependency, since you would need this store to reach the
|
|
# credential that opens it.
|
|
|
|
path "operators/data/*" {
|
|
capabilities = ["create", "read", "update", "list"]
|
|
}
|
|
|
|
path "operators/metadata/*" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
# Delete is deliberately absent. A credential is retired by writing its
|
|
# successor — KV v2 keeps the prior version, which is the history that did not
|
|
# exist when the LLDAP predecessor was overwritten on 2026-08-27 and lost.
|
|
# Destroying a version is a separate, deliberate act under a broader identity.
|