This is absolutely not how WE use it, but I'm sure lots of people do stupid stuff like that. We actually deploy vault tokens to every user(happens at login tim

This is absolutely not how WE use it, but I'm sure lots of people do stupid stuff like that. We actually deploy vault tokens to every user(happens at login time, since login authentication happens against vault). So we can deploy secrets directly to end users using vault policy. Applications that are not ran/started directly by the user find other means of getting their secret 0(VAULT_TOKEN), usually through nomad, but in the rare case it's a standalone application not run under nomad, we seed the startup with a token by hand, and then have a process handle renewals, etc.