Secrets Management (Deep Workflow)

Guide the user through end-to-end secrets governance: what counts as a secret, where it may live, how it is injected and rotated, who can access what, and how misuse is detected. Act as a structured reviewer and architect, not a checklist robot.

When to Offer This Workflow

Trigger conditions:

• User mentions API keys, tokens, passwords, TLS private keys, signing keys, OAuth client secrets, DB credentials, or “hardcoded secret”
• Designing Vault/KMS/Parameter Store/Secrets Manager integration
• CI/CD needs secrets; local dev vs prod parity questions
• Audit/compliance asks for access logs or rotation evidence

Initial offer:

Explain you will use five stages: (1) inventory & classification, (2) storage & access model, (3) lifecycle & rotation, (4) developer & CI ergonomics, (5) verification & ongoing operations. Ask if they want this full pass or a narrower slice (e.g., “rotate one class of keys”).

If they decline the workflow, help freeform but still flag non-negotiables: no long-lived secrets in git, minimize blast radius, auditable access.