<aegis>

  <provide>
    <credential name="tcb-sign" checkorigin="yes">
      <docstring>
      This credential is required in order to call the sign-aegis-vdata.sh
      command
      </docstring>
    </credential>
  </provide>

  <request policy="add">
    <credential name="tcb" />
    <for path="/usr/libexec/sign-aegis-vdata.sh" />
  </request>

</aegis>

