Hey Guys, I'm trying to setup a custom role that only allows access to a couple secrets, one folder, plus one specific secret, however, in the visualizer, when I add the second condition, it says I can now access all these secrets when I add the name equal to condition...? I'm a little confused, I would have assumed that allow a secret for one name, would only allow that secret to be fetched...? Similarly, when I try and list all secrets with a machine identity given only this roll, I can fetch all secrets? I figure I'm doing something wrong here, but can't figure out exactly what. If you could help me figure out what I am missing, that would be great!

Hi @Hyden Polikoff, I tried re-creating your issue but was unsuccessful. Am I missing anything in my setup? I also tried listing secrets using a machine identity with the custom role, and it only listed secrets in /ai and the single secret in /postgres as expected.

Huh, interesting you can see that the dialogue under the /postgres folder is different, I see you don't have the global forbid, let me try that