Example Vault namespace user policy

ns-user.acl

# Allow tokens to look up their own properties
path "acme/auth/token/lookup-self" {
    capabilities = ["read"]
}

# Allow a token to look up its own capabilities on a path
path "acme/sys/capabilities-self" {
    capabilities = ["update"]
}

# List namespaces
path "acme/sys/namespaces" {
  capabilities = ["list"]
}

path "acme/cubbyhole/*" {
  capabilities = ["create", "delete", "list", "read", "update"]
}

path "acme" {
  capabilities = ["list", "read"]
}

path "acme/+" {
  capabilities = ["list", "read"]
}