# Lets the agents AppRole mint ephemeral Gitea tokens for the unkin-agent bot,
# so AI coding agents authenticate to git.unkin.net as their own least-privilege
# identity instead of Ben's account. Reading gitea/creds/unkin-agent returns a
# lease-bound token scoped by the role (write:repository, write:issue, read:user
# -- never merge/admin). Mirrors the agent-* Kubernetes creds binding pattern.
---
rules:
  - path: "gitea/creds/unkin-agent"
    capabilities:
      - read

auth:
  approle:
    - agents