# Role minting ephemeral tokens for the unkin-agent bot user -- the shared
# identity Ben's AI coding agents use to submit work. The agent clones/pushes
# code and opens pull requests, so it gets write on repositories (clone + push +
# PR create) and write on issues (PR/issue comments). Read is implied by write.
# No admin/org/user-write scopes, so it can never merge via API privilege; merge
# is blocked separately by branch protection (merge whitelist = Owners).
# read:user is required because tea (and most API clients) validate the login
# via GET /api/v1/user, which 403s without it.
# Reading gitea/creds/unkin-agent mints a lease-bound token deleted from Gitea
# on revoke/expiry. Consumed by the "agents" AppRole (see
# policies/gitea/creds/unkin-agent.yaml).
---
username: unkin-agent
scopes:
  - write:repository
  - write:issue
  - read:user
token_name_prefix: vault-unkin-agent
ttl: 3600      # 1h
max_ttl: 14400 # 4h