# auditor — read-only governance visibility. Can see HOW the system is
# configured and WHO can do what, but CANNOT read any secret material and
# CANNOT change anything. The independent "governance lens".

# Configuration visibility
path "sys/health"           { capabilities = ["read"] }
path "sys/seal-status"      { capabilities = ["read"] }
path "sys/mounts"           { capabilities = ["read"] }
path "sys/auth"             { capabilities = ["read"] }
path "sys/metrics"          { capabilities = ["read"] }

# Policy visibility (read the rules, not change them)
path "sys/policies/acl"     { capabilities = ["list"] }
path "sys/policies/acl/*"   { capabilities = ["read"] }

# Identity visibility (who exists) — names only, not secrets
path "identity/entity/name" { capabilities = ["list"] }
path "identity/group/name"  { capabilities = ["list"] }

# Audit device configuration visibility (sudo required for this path)
path "sys/audit"            { capabilities = ["read", "sudo"] }

# NOTE: intentionally NO `secret/`, `personal/`, `pki*`, `ssh/`, `transit*`
# data paths — an auditor reviews governance, not secrets.