# gitea-push-ro — materialized from live OpenBAO (policy-as-code).
path "secret/data/gitea/push" { capabilities = ["read"] }