one key per machine, and one key that stays off every machine

The convenient shape for a secret store is one credential that reads everything, held by every machine. The cost is that any machine becomes a copy of the whole keychain, and one mistaken read becomes indistinguishable from a legitimate one. The estate moved to a policy per machine: reads scoped to what that machine's workloads need, plus explicit denials against other machines' entries. The denials were then proven the only way that counts, by making the request with the actual credential and watching it be refused, rather than by reading the policy back and agreeing with it.

The same pass removed a category of secret from the store entirely. The key that opens the offsite archives was taken out and kept as an offline copy, hash-checked, with a break-glass duplicate. The automation that runs the archives uses its own passphrase and never fetches that key. One compromise should not hand over both the archive and the means to read it.

The lesson that arrived second: narrowing a credential and writing it into the store changed nothing for the process already running with the old one. The template that would have re-rendered never fired, so the scoped credential only took effect when the workload restarted. Revocation is a rollout.

What it proves is that blast radius is a per-machine property that has to be engineered, and that a credential is not revoked when the policy changes. It is revoked when the consumer stops using the old one.