# Grant read-only access to secrets path "kv/data/name/domain/qualified/fully/os/root/creds" { capabilities = ["read"] }