path "secret/data/immich-db" {
    capabilities = ["read"]
}