Tanvir Ahmed
03/27/2026, 3:59 PMJake (Infisical)
03/27/2026, 7:37 PM/app for your application secrets and /infra for the stuff your app doesn't touch for example. Then scope your role so it only has access to /app and run:
infisical run --env=prod --path=/app -- your-start-command
That way the CLI only ever asks for secrets you have permission to read and there aren't any errors or crashes.
Basically the idea is to organize secrets so you're only fetching what is yours and not fighting permissions at fetch time. Hope this helps!