Static comparison of ops-warden's catalog against the policy file: 8 high-risk
lanes with concrete KV paths are not denied, four of which were already graded
high before the 2026-08-19 regrade, so the divergence is pre-existing.
ops-warden's CLI layer only protects the ops-warden path; the OpenBao policy is
what protects a direct bao kv get, which is the actual 2026-07-16 vector.
Not confirmed against the live OpenBao — ops-warden's token is expired, so the
deployed policy may differ from the file. Stated as such.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
