3fbb610d1f
Answers the-custodian 641673a4. An attended read-only check (receipt docs/evidence/2026-09-23-openbao-platform-admin-check.json) found: - live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27); repo now matches live (sha256 0ca5b821...). No live write. - role also attaches operator-custody (undeclared); declared here. - role declared as openbao/auth/netkingdom-platform-admin-role.json. - default policy is attached and grants revoke-self/lookup-self, so the suspected missing grant is not the cause of warden's unconfirmed revocation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
55 lines
1.6 KiB
HCL
55 lines
1.6 KiB
HCL
# Full platform-operator policy for the initial OpenBao bootstrap phase.
|
|
#
|
|
# Use only for trusted S3 platform operators. This is intentionally broad so
|
|
# the root token can be retired after bootstrap. Prefer narrower workload
|
|
# policies for application access.
|
|
|
|
path "sys/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
|
}
|
|
|
|
path "auth/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
|
}
|
|
|
|
path "identity/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
path "platform/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
path "database/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
path "pki/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
path "ssh/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
path "cubbyhole/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
path "secret/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
# Client/tenant commercial secrets (WARDEN-WP-0028). Separate mount from
|
|
# platform/workloads so tenant lanes are not mixed with fleet service secrets.
|
|
path "tenants/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
|
|
# reins/ -- per-rein credential secrets (glas-harness family), mount added
|
|
# 2026-07-27 by ops-mason (MASON-WP-0001-T05). Added here so platform-admin
|
|
# can complete paste-once-provision into any rein's path, matching every
|
|
# other KV mount already listed in this policy.
|
|
path "reins/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|