feat(realm): a machine identity for the autonomous run

Browse Source

serviceAccountsEnabled on the Approvisionnement client, and its service account
holds read_only — the least privilege its periodic run needs. The MCP server
maps that to a consumer group, so the catalog's write tool is invisible to this
identity rather than merely unused.

The classic-models-mandate client added earlier stays, unused. An autonomous run
acts for itself; a mandate belongs where a person's own authority is in play.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

...

This commit is contained in:

Stéphane Tailland

2026-08-29 17:51:20 +02:00

parent 5048a154c5

commit 9f2bd159d8

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

k8s/keycloak/configmap-realm.yaml

+1 -1

File diff suppressed because one or more lines are too long