openbao-secrets

OpenBao Secrets Access

How to get a credential without creating a standing one, and how to handle it once you have it. Two rules carry most of the weight: mint, don't store, and reading is pre-authorized, writing is gated.

State warning: which engines are configured differs per environment and changes over time. Verify capability before relying on it (below) — never assume an engine is live because a config flag says enabled. A default is not a running system.

Step 0: Which identity am I?

Every later step depends on who is asking. Answer this before touching a store. Three identities exist, and they are not interchangeable:

Identity	What it is	May do
Trusted automation identity	A dedicated non-human principal the automation runs as, with its own login credential and its own policy	Pre-authorized reads; the gated writes its policy allows; the only identity that may hold unattended privilege
Interactive operator	A person at a terminal, authenticating as themselves	Pre-authorized reads; performs the human gate that authorizes a write
Untrusted harness	Any agent or tool session that has not been separated onto the automation identity — it borrows whoever launched it	Pre-authorized reads only; no writes, no unattended privilege

Rules that follow from the table:

• Reads are pre-authorized for all three. Fetching a secret you are entitled to needs no ceremony regardless of identity.
• A gated write happens under the trusted automation identity, authorized by the interactive operator's gate (Step 3). An untrusted harness never writes, and never obtains a credential that would let it.
• Unattended privilege — a credential that acts with no human present — exists only under the automation identity. If you cannot name which identity you are, you are the untrusted harness; act accordingly.
• Before any live write, confirm both facts from the store, not from memory: which identity the current token belongs to (auth/token/lookup-self) and the exact capability on the exact path (sys/capabilities-self).
• A read-tier AppRole cannot list roles or policies. An inventory of what exists needs the admin identity; an empty list from a read tier is a permission result, not evidence that nothing is there.