---
id: w6/m8/t004
title: "Document the operator manager-role's cluster-wide secrets CRUD as a deliberate, justified exception, or file a defense-in-depth follow-up"
worker: worker6
status: done
estimate: 20m
depends_on: [w6/m8/t002]
---

## Objective

Address the adjacent finding from `w6/002`: the operator's `manager-role` still has cluster-wide full-CRUD on core `secrets` (`lego/operator/config/rbac/role.yaml`), justified by owner-GC of build/env secrets across dynamic tenant namespaces — but this milestone is scoped to the bex-api RBAC only, so decide explicitly rather than silently leaving it unaddressed.

## Context

- `lego/operator/config/rbac/role.yaml:7-19`

## Steps

1. Confirm the operator's cluster-wide secrets CRUD is still justified post-split (owner-GC reasoning from `w6/002`).
2. Either document the exception inline (a comment in `role.yaml` + a note in `docs/ADR022-tenant-isolation.md` or similar) or file a scoped follow-up inbox note for an admission/NetworkPolicy guard restricting the operator SA from platform-namespace secrets.

## Files

- `lego/operator/config/rbac/role.yaml`
- `.pm/w6/` (new inbox note, if filed)

## Acceptance criteria

- [ ] Either an inline documented decision or a new inbox note exists — this is not silently dropped.

## Out of scope

- Implementing the admission/NetworkPolicy guard itself, if filed as a follow-up.
