[pas]

You can audit access/key-genesis, easily revoke keys, have stricter rules for giving out keys.

It's a complexity-compartmentalization trade off, that is usually recommended for better IT sec posture. Allows other stuff [IDS - intrusion detection system] to be built on top more easily.

Basically leads to the secrets in the secret vault mentality, so any time you see a secret not in the vault, you can sound the alarm.