f135c0af35
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
21 lines
696 B
HCL
21 lines
696 B
HCL
# Ephemeral read policy for WH-ENG-20260822-AUDIT-E2-02.
|
|
#
|
|
# The External Secrets Operator may read exactly two per-engagement values.
|
|
# It cannot read the audit-core sender registry, the expired -01 engagement,
|
|
# or any other engagement path.
|
|
|
|
path "platform/data/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-a" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-a" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-b" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-b" {
|
|
capabilities = ["read"]
|
|
}
|