Automation Needs a Permission Model
Automation should be fast inside a narrow authority boundary rather than powerful enough to mutate anything.
least privilege
An Operations Portal Should Not Become a Web Terminal
Convenient arbitrary shell access would collapse the separation between reviewed operations and unrestricted host control.
Why 0600 Was Too Strict for a Containerized Private Key
The strictest-looking file mode is not automatically the safest usable mode when a non-root service must read the key.
Backup Monitoring Needs UNKNOWN as a Real State
Least-privilege monitoring sometimes cannot read protected backup evidence, and treating that access failure as healthy would be dangerous.
CSP connect-src Should Be a Small Network Allowlist
Browser-side health checks needed cross-origin access, but the fix was two explicit origins rather than a broad wildcard.
Path-Based Policies Make Least Privilege Concrete
The difference between operator, runtime and backup identities is visible in the exact OpenBao paths and capabilities they receive.
Deep Database Collection Did Not Need Copied Passwords
Copying every application database password into the observability stack would have expanded the secret blast radius just to collect metrics.
UNKNOWN and FAIL Mean Different Things in Backup Monitoring
Protected evidence that a low-privilege checker cannot read should not be reported as healthy or corrupt.
AppRole Is Machine Identity, Not a Shared Master Password
Workloads should authenticate to the secret authority with narrow machine identities rather than one credential copied across services.
Least-Privilege Backup Receipts Let Operators Verify Without Reading the Backups
Operators need evidence that backups succeeded without necessarily gaining access to the protected data itself.