OpenBao token policies define the real control-plane boundary
OpenBao manages secrets, encryption operations and certificate issuance. A reachable UI or API endpoint is only the outer layer. The meaningful authority belongs to the token and its attached policies, and a token may have much broader reach than the page that created it.
A narrow public fingerprint
On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned zero for app="OpenBao" and 81 for title="OpenBao". The title total is small and should be reviewed individually because a product page can belong to documentation, a managed service or a self-hosted deployment. It is not a count of unsecured secret stores.
OpenBao's concepts documentation describes policies as path-based and deny by default. An empty policy grants no permission. That model is useful for review because each capability can be tied to a path and operation.
Find the broad tokens first
A root token can do anything in OpenBao and is the highest-value credential in the deployment. Inventory root-token creation paths and emergency use. Remove standing root tokens where the operating model allows and require an explicit recovery process through the documented generate-root mechanism.
For non-root tokens, list the attached policies and the paths they cover. A token that can create child tokens, modify auth methods or change policies is an administrative credential even if it also looks like an application token. Separate human administration from workload authentication.
Authentication backends create client tokens after identity verification. External identity changes may affect renewal, but token lifetime and policy still determine the active authority. Review token TTL, use limits, renewal policy and revocation behavior.
Pair public evidence with internal checks
For each owned endpoint, confirm the listener, reverse proxy, auth methods and namespace layout. Test a token with only a narrow secret path, a token after policy removal and an expired workload token. Record the exact denied path and the policy that produced the decision.
Protect the audit and seal-key paths as carefully as the secret data. A control plane that can recover or decrypt everything needs stronger monitoring than a single application.
The scan supplies a small candidate set. Token policy, root-token custody and auth-method reach decide whether the control plane is bounded.
Top comments (0)