# events[].sql_query.sql
SELECT * FROM "roles" WHERE "role_id" = 'cucumber:user:bob'

# events[].sql_query.sql
SELECT * FROM "resources" WHERE "resource_id" = 'cucumber:variable:probe'

# events[].sql_query.sql
    WITH 
      "ordered_secrets" AS 
        (SELECT * FROM "secrets" WHERE ("resource_id" = 'cucumber:variable:probe') ORDER BY "version" DESC LIMIT 20), 
      "delete_secrets" AS 
        (SELECT * FROM "secrets" LEFT JOIN "ordered_secrets" USING ("resource_id", "version") WHERE (("ordered_secrets"."resource_id" IS NULL) AND ("resource_id" = 'cucumber:variable:probe'))) 
    DELETE FROM "secrets"
    USING "delete_secrets"
    WHERE "secrets"."resource_id" = "delete_secrets"."resource_id" AND
      "secrets"."version" = "delete_secrets"."version"

# metadata.name
A foreign role can be granted permission to update a secret.

# metadata.feature
RBAC privileges control whether a role can update and/or fetch a secret.