87a450e9a3
Viktor asked that emo be able to edit his own secrets with full access. emo's personal-emo policy was read-only (read on data, read/list on metadata), so he could view but not change his personal secrets. Widen it to the same self-service capability set every namespace-owner already has over their own tree: create/read/update/delete/list on secret/data/emo(+/*) and list/read/delete on secret/metadata/emo(+/*). Scope is unchanged — still only emo's own secret/emo subtree, still a named exception that does not widen the power-user tier in general. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| main.tf | ||
| providers.tf | ||
| secrets | ||
| terragrunt.hcl | ||