{
  "tenant": "tenant:platform",
  "subject": {
    "id": "secrets-engine",
    "type": "service"
  },
  "action": "apply",
  "resource": {
    "id": "catalog:openrouter-llm-connect",
    "type": "secret-catalog-lane",
    "system": "secrets-engine",
    "attributes": {
      "stage": "prod",
      "fields": [],
      "policy_targets": [
        "se-prod-openrouter-llm-connect"
      ],
      "auth_targets": [
        "se-prod-openrouter-llm-connect"
      ]
    }
  },
  "context": {
    "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
    "catalog_target": {
      "kind": "kv",
      "org": "coulomb",
      "repo": "llm-connect",
      "mount": "platform",
      "path": "workloads/activity-core/llm-connect/llm-connect-provider-secrets",
      "fields": [
        "OPENROUTER_API_KEY"
      ],
      "mount_management": "existing",
      "consumers": [
        {
          "name": "llm-connect-activity-core",
          "auth": "kubernetes",
          "claim": "serviceaccount:external-secrets/external-secrets",
          "purpose": "sync llm-connect-provider-secrets for the activity-core deployment"
        },
        {
          "name": "intelligence-radar-key-check",
          "auth": "approle",
          "claim": "catalog:openrouter-llm-connect",
          "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference"
        }
      ],
      "delivery_modes": [
        "exec-env",
        "read-check"
      ],
      "delivery_auth": {
        "method": "approle",
        "management": "engine",
        "policy_name": "se-prod-openrouter-llm-connect",
        "role_name": "se-prod-openrouter-llm-connect",
        "token_ttl": "15m",
        "token_max_ttl": "30m",
        "secret_id_ttl": "15m",
        "secret_id_num_uses": 1,
        "token_num_uses": 8
      },
      "delivery_config": {
        "exec_owner": {
          "status": "pending",
          "owner": "intelligence-radar-key-check",
          "reason": "Pin tools/openrouter_key_check.py and its protected Python runtime, exact argv, private cwd and fixed environment after custody-owner admission. The pending binding refuses exec before consume or secret retrieval."
        }
      },
      "auth_capability": {},
      "workload_delivery": [
        {
          "mode": "external-secrets",
          "owner": "railiance-platform + llm-connect"
        }
      ]
    },
    "human_control": true
  }
}