# Check what policies vault has applied to my token in the Web UI

**URL:** <https://discuss.hashicorp.com/t/check-what-policies-vault-has-applied-to-my-token-in-the-web-ui/23005>\
**Category:** Vault\
**Created:** [April 9, 2021, 7:06pm UTC](https://discuss.hashicorp.com/t/check-what-policies-vault-has-applied-to-my-token-in-the-web-ui/23005 "2021-04-09T19:06:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![alongwill](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/alongwill/32/18522_2.png) [@alongwill](https://discuss.hashicorp.com/u/alongwill)\
**Post date:** [April 9, 2021, 7:06pm UTC](https://discuss.hashicorp.com/t/check-what-policies-vault-has-applied-to-my-token-in-the-web-ui/23005/1 "2021-04-09T19:06:09Z")

</div>

We’re using Vault 1.7.0 (and [GitHub - banzaicloud/bank-vaults: A Vault swiss-army knife: a K8s operator, Go client with automatic token renewal, automatic configuration, multiple unseal options and more. A CLI tool to init, unseal and configure Vault (auth methods, secret engines). Direct secret injection into Pods.](https://github.com/banzaicloud/bank-vaults)) running in EKS. We’re using GitHub teams to assign vault policies to different users.

Here is a summarised version of the k8s configuration:

```auto
vault:
  ...

  spec:
  ...
    externalConfig:
      auth:
        - type: github
          config:
            organization: Foo
          map:
            teams:
              # map of GitHub teams to Vault policies
              blue-team: blue-team-secrets
              green-team: green-team-secrets
      secrets:
      ...
      policies:
        - name: blue-team-secrets
          rules: |
            path "static/metadata/blue-team" {
              capabilities = ["list"]
            }
            path "static/data/blue-team/*" {
              capabilities = ["list", "read", "create", "update", "delete"]
            }
        - name: green-team-secrets
          rules: |
            path "static/metadata/green-team" {
              capabilities = ["list"]
            }
            path "static/data/green-team/*" {
              capabilities = ["list", "read", "create", "update", "delete"]
            }

```

I was in the blue-team and can add new versions of secrets under `static/data/blue-team`. I then added myself to the green-team, but can only read secrets under `static/data/green-team`. It looks like vault has applied the `green-team-secrets` policy to my account but only `list` and `read` permissions.

I tried renewing my token via the web UI, logging out and logging in again, but to no avail.

Is it possible to see via the Vault web UI which policies Vault thinks apply to me?