You can audit access/key-genesis, easily revoke keys, have stricter rules for giving out keys. It's a complexity-compartmentalization trade off, that is usuall

You can audit access/key-genesis, easily revoke keys, have stricter rules for giving out keys. It's a complexity-compartmentalization trade off, that is usually recommended for better IT sec posture. Allows other stuff [IDS - intrusion detection system] to be built on top more easily. Basically leads to the secrets in the secret vault mentality, so any time you see a secret not in the vault, you can sound the alarm.