What are the minimum necessary permissions?

[zwiebelspaetzle]

The readme uses the root token of a dev setup. In prod, what are the minimum permissions needed for this script to run?

[madrisan]

For reading secrets (get) and monitor the token expiration (token-lookup) you do not need a root token.
In general you just need a token associated to a policy just allowing the actions you need.
For instance the get command need a token able to read in a sub-tree of secret/.
The token-lookupmethod works with any given token of course.
Conversely the method policy requires a root token or the appropriate rights.

[madrisan]

It's not necessary to execute this binary as root, only a simple execution right.