path "ssh-host-signer/roles/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}