# Grant read-only access to secrets
path "kv/data/name/domain/qualified/fully/os/root/creds" {
    capabilities = ["read"]
}