diff --git a/plugins/openbao-session/README.md b/plugins/openbao-session/README.md
index 611c82a..b7ecc45 100644
--- a/plugins/openbao-session/README.md
+++ b/plugins/openbao-session/README.md
@@ -27,11 +27,15 @@ export BAO_ADDR=https://10.104.0.12:8200
 export BAO_CACERT=/opt/openbao/tls/tls.crt
 export BAO_TOKEN=<token admin Anda>   # jangan di-paste ke chat
 
-# 1. Policy bootstrap: bisa membuat token, TIDAK bisa membaca secret
+# 1. Policy bootstrap: bisa membuat token, TIDAK bisa membaca secret.
+#    Wajib menyertakan auth/token/create/* agar pembuatan token via -role (entity-alias) diizinkan.
 cat > /tmp/openbao-session-creator.hcl <<'EOF'
 path "auth/token/create" {
   capabilities = ["create", "update", "sudo"]
 }
+path "auth/token/create/*" {
+  capabilities = ["create", "update", "sudo"]
+}
 path "auth/token/renew-self"  { capabilities = ["update"] }
 path "auth/token/revoke-self" { capabilities = ["update"] }
 path "auth/token/lookup-self" { capabilities = ["read"] }