concourse_policy.hcl

path "sys/*" {
  policy = "deny"
}

path "secret/concourse/*" {
  policy = "read"
}