Vault Namespace Token Policy Inheritance: Unclear Automatic Propagation Constraint

Vault Namespace Token Policy Inheritance

The goal is to clarify whether a token created in a parent namespace with an attached policy automatically grants the same policy permissions when the token is used to access secrets in a child namespace.

Current documentation does not state if the policy is inherited, overridden, or requires explicit binding in each child namespace, and observed behavior differs between Vault releases before and after version 1.10, creating uncertainty for administrators upgrading or designing multi‑namespace deployments.

Does a parent‑namespace token inherit its attached policies in child namespaces? If inheritance does not occur, what explicit policy binding is needed for each child namespace? How does the behavior differ between Vault versions prior to 1.10 and those at or after 1.10?