// Policy for PROD's render identity on vps2.
//
// Reads the shared set plus prod's own overrides — the OpenBao equivalent of
// "common.yaml then prod.yaml, last-wins".
//
// Note what this policy does NOT grant: beta. vps2 runs prod and beta side by side
// with one filesystem and one SSH credential, so the host is emphatically not an
// isolation boundary between them (infra/CLAUDE.md is explicit about this). Separate
// identities with separate policies do not fix that — a foothold on the box can read
// both AppRole credentials — but they do mean a *mistake* cannot cross the line:
// prod's render cannot accidentally pull beta's database password, and the audit log
// attributes every read to one environment or the other.

path "thermograph/data/common" {
  capabilities = ["read"]
}

path "thermograph/metadata/common" {
  capabilities = ["read", "list"]
}

path "thermograph/data/env/prod" {
  capabilities = ["read"]
}

path "thermograph/metadata/env/prod" {
  capabilities = ["read", "list"]
}

path "thermograph/data/env/beta" {
  capabilities = ["deny"]
}

path "thermograph/data/env/dev" {
  capabilities = ["deny"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "auth/token/renew-self" {
  capabilities = ["update"]
}