Harden secret provisioning and lifecycle controls

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
2026-08-23 12:05:58 +02:00 · 2026-08-23 12:05:58 +02:00 · 3a1bd4f1c8
commit 3a1bd4f1c8
parent 0617923ff1
23 changed files with 1369 additions and 162 deletions
--- a/policies/secrets-engine-prod.hcl
+++ b/policies/secrets-engine-prod.hcl
@ -15,7 +15,7 @@
 # Apply approved production lane values (provisioning) and metadata.
 # Owner-scoped prod lanes (e.g. whynot-design/...) — NOT under build/ or test/.
 path "secret/data/+/*" {
-  capabilities = ["create", "update"]
+  capabilities = ["create", "update", "patch"]
 }
 path "secret/metadata/+/*" {
  capabilities = ["create", "read", "update", "list"]