# operator — day-to-day USE of secrets engines, but NO administration.
# Deliberately cannot manage mounts, auth methods, policies, or identity, and
# has no access to the personal/ or transit-personal/ trust domains. This is
# the policy a human should hold for routine work instead of full `admin`.

# KV v2 data (shared secrets)
path "secret/data/*"        { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
path "secret/metadata/*"    { capabilities = ["read", "list", "delete"] }

# PKI: issue/sign leaf certs (NOT manage the CA)
path "pki_int/issue/*"      { capabilities = ["update"] }
path "pki_int/sign/*"       { capabilities = ["update"] }
path "pki/issue/*"          { capabilities = ["update"] }

# SSH: sign user/host certs (NOT manage the CA or roles)
path "ssh/sign/*"           { capabilities = ["update"] }

# Transit: use existing keys (NOT create/rotate/delete)
path "transit/encrypt/*"    { capabilities = ["update"] }
path "transit/decrypt/*"    { capabilities = ["update"] }

# TOTP codes
path "totp/code/*"          { capabilities = ["create", "read", "update"] }

# Read-only operational visibility
path "sys/mounts"           { capabilities = ["read"] }
path "sys/health"           { capabilities = ["read"] }
path "sys/seal-status"      { capabilities = ["read"] }

# Token self-management
path "auth/token/lookup-self" { capabilities = ["read"] }
path "auth/token/renew-self"  { capabilities = ["update"] }
path "auth/token/revoke-self" { capabilities = ["update"] }