If a role is able to read a secret from Vault, but unable to change...

The missing capability is update. In Vault ACL policies, read allows a client to retrieve data from a path, but it does not allow changing the data at that path. To modify an existing value, the policy must grant update capability. The list capability only allows listing keys or path entries; it does not read or modify secret values. The delete capability removes data, but it is not needed to change an existing value. The sudo capability is reserved for root-protected paths and administrative operations, not normal secret modification. Since the role can already read the secret, option E is already present and cannot be the missing permission. HashiCorp’s policy documentation states that update allows changing data at a path, while read only allows reading data.

================