# Least privilege for the application's own token: read two KV v2 paths, nothing else.
# KV v2 inserts "data/" into the API path, so the policy path is secret/data/<name>, not secret/<name>.
path "secret/data/secrets-demo" {
  capabilities = ["read"]
}
path "secret/data/application" {
  capabilities = ["read"]
}