Founder decision 2026-11-06, option A, 1 h tokens. ServiceAccount sso/nk-agent-status without automount;
read-only Jobs, pods, Deployments and ExternalSecrets in sso; one named ConfigMap in informed-decision;
the informed-decision Application in argocd. No Secrets, pod logs, exec, writes or cluster scope.
Guard: tests/test_nk_agent_status_rbac.py. The Application follows in the next commit, pinned here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
4e60f69f93