// Policy for BETA's render identity on vps2. Mirror of tg-host-prod.hcl.
//
// Beta legitimately reads the shared set: unlike dev, beta is on vps2 and already
// co-resident with prod, so withholding `shared` from it would buy nothing while
// breaking the render (beta's 24 live keys = beta.yaml's 8 + shared's 16).

path "thermograph/data/common" {
  capabilities = ["read"]
}

path "thermograph/metadata/common" {
  capabilities = ["read", "list"]
}

path "thermograph/data/env/beta" {
  capabilities = ["read"]
}

path "thermograph/metadata/env/beta" {
  capabilities = ["read", "list"]
}

path "thermograph/data/env/prod" {
  capabilities = ["deny"]
}

path "thermograph/data/env/dev" {
  capabilities = ["deny"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "auth/token/renew-self" {
  capabilities = ["update"]
}