in as much as possible, I make it write RO tools with keys in vaults, then verify the tools are RO then have it operate the tools with the vaults in a way that it doesn’t need to read the creds

If I have the time, i do it all myself, but i don’t often have time