Policies and ACLs

Vault's HCL policies: path globs, capabilities such as read, write, delete, list, sudo and deny, how policies combine on a token, and Sentinel EGPs and RGPs for attribute-based rules. Interviewers use it to check that you can express least privilege over a path hierarchy rather than handing out root.