Tailscale Connectivity and Tailscale SSH Are Different Permissions
A peer can be reachable over the tailnet while an SSH login is correctly denied by another policy layer.
ACL
A Secret Manager Is an Authorization System, Not Just Encrypted .env
OpenBao adds identity, policy, versioning, leases and audit around secrets instead of merely moving plaintext to a different file.
The Execute Bit on a Directory Is Really a Path Permission
A protected parent directory can block a perfectly readable child file because directory execute controls traversal.
The ACL That Worked Perfectly and Locked Me Out
My first memorable ACL mistake was technically correct: it blocked exactly what I told it to block, including the management traffic I still needed.
Path-Based Policies Make Least Privilege Concrete
The difference between operator, runtime and backup identities is visible in the exact OpenBao paths and capabilities they receive.
Traverse-Only ACLs Are Useful When Secrets Live Under Root-Owned Trees
A service can be allowed through one protected directory without being allowed to inspect the directory itself.