Astral needs a mechanism for determining whether a supplied token has the rights to perform a read operation

[dave-gantenbein]

Because Astral communicates with Vault using it's own identity token, we need to verify the upstream user identity has rights to read a secret.

1. fetch policies for the upstream user
2. validate that the KV policy is possessed by the user

For the MVP, the KV policy will be unique for each secret and only granted to the identity that created the secret. However, we will probably need to use groups in a future story.

[GeorgeJahad]

It seems like we need more info from the dallas team here.

[suprjinx]

yes need more info -- particularly how group permissions should work