schema_version: "0.1"
version: 1
access_refs:
  - access_ref_id: ACC-demo-host
    type: cloud_account
    system: other
    identifier: "demo-host:account:psl-prod"
    owner: "platform-team"
    request_access_steps:
      - "Request access from platform-team via internal ticket."
      - "Ensure you have SSO role \"psl-read\" for read-only, or \"psl-admin\" for overrides."
    security_notes: "Do not store credentials here; store pointers only."
  - access_ref_id: SEC-datadog
    type: secret
    system: vault
    identifier: "vault:secret/observability/datadog_api_key"
    owner: "platform-team"
    request_access_steps:
      - "Ask platform-team to grant Vault read to this path."
      - "Verify access by reading the secret name only (do not paste key into state)."
  - access_ref_id: ROLE-psl-approver
    type: sso_role
    system: okta
    identifier: "okta:role:psl-decision-approver"
    owner: "eng-leads"
    request_access_steps:
      - "Manager approves role assignment."
      - "Role required to approve decisions and break stale claims."
