f3ba7ca882
Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
7 lines
191 B
HCL
7 lines
191 B
HCL
path "platform/data/workloads/approval-engine/operator-client" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/approval-engine/operator-client" {
|
|
capabilities = ["read"]
|
|
}
|