docs: refresh bootstrap scope role-prefix refs

This commit is contained in:
Peter Steinberger
2026-04-04 18:46:30 +01:00
parent 131a78d3f3
commit 8fd53cdf86
3 changed files with 7 additions and 1 deletions

View File

@@ -112,7 +112,9 @@ bounded role entries in `deviceTokens`:
For the built-in node/operator bootstrap flow, the primary node token stays
`scopes: []` and any handed-off operator token stays bounded to the bootstrap
operator allowlist (`operator.approvals`, `operator.read`,
`operator.talk.secrets`, `operator.write`).
`operator.talk.secrets`, `operator.write`). Bootstrap scope checks stay
role-prefixed: operator entries only satisfy operator requests, and non-operator
roles still need scopes under their own role prefix.
### Node example