tegwick
1cbaac7a73
Align path and fields (API_KEY, API_USER) with provisioned secret; policy and OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.
13 lines
503 B
HCL
13 lines
503 B
HCL
# Least-privilege read policy for Binky Qonto bank API credentials.
|
|
# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
|
|
# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
|
|
# Consumers map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
|
|
# qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.
|
|
|
|
path "tenants/data/binky/qonto-api" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "tenants/metadata/binky/qonto-api" {
|
|
capabilities = ["read"]
|
|
}
|