# Admin policy — broad day-to-day administration WITHOUT being root.
# Deliberately omits the most dangerous root-only capabilities (sys/raw,
# generating root tokens, re-keying, raw storage access). Use the root token
# only for break-glass operations; this policy is for normal admin work.

# Manage auth methods
path "auth/*"          { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
path "sys/auth/*"      { capabilities = ["create", "read", "update", "delete", "sudo"] }
path "sys/auth"        { capabilities = ["read"] }

# Manage ACL policies
path "sys/policies/acl/*" { capabilities = ["create", "read", "update", "delete", "list"] }
path "sys/policies/acl"   { capabilities = ["list"] }

# Manage secrets engines (mount/tune/unmount)
path "sys/mounts/*"    { capabilities = ["create", "read", "update", "delete", "sudo"] }
path "sys/mounts"      { capabilities = ["read"] }

# Work with secrets data in mounted engines. One rule per engine mount path.
# NOTE: each secrets engine mounted at a NEW path needs its own rule here.
# The UI runs a preflight capability check on the mount path, so missing = 403.
path "secret/*"        { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
path "ssh/*"           { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
path "pki/*"           { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
path "pki_int/*"       { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
path "totp/*"          { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
path "transit/*"       { capabilities = ["create", "read", "update", "patch", "delete", "list"] }

# Lease management
path "sys/leases/*"    { capabilities = ["create", "read", "update", "delete", "list", "sudo"] }

# Operational visibility
path "sys/health"      { capabilities = ["read", "sudo"] }
path "sys/seal-status" { capabilities = ["read"] }
path "sys/mounts/+/tune" { capabilities = ["read", "update"] }
path "sys/capabilities"      { capabilities = ["create", "update"] }
path "sys/capabilities-self" { capabilities = ["create", "update"] }

# Allow token self-management
path "auth/token/lookup-self"   { capabilities = ["read"] }
path "auth/token/renew-self"    { capabilities = ["update"] }
path "auth/token/revoke-self"   { capabilities = ["update"] }