policy app-read (vault/app-read.hcl) attached to a 1h token
application with that token: started, db.password = password-v1
same token, vault kv get secret/other-team:
  * permission denied
same token, vault kv put secret/secrets-demo db.password=hijacked:
  * permission denied