# demo-app — materialized from live OpenBAO (policy-as-code).
path "secret/data/demo-app/*" { capabilities=["read"] }
path "secret/metadata/demo-app/*" { capabilities=["read","list"] }