Is anyone familiar with the secure introduction workflow using Hashicorp Vault? An orchestrator gets no more than a one-time use "cubbyhole" introduction token

Is anyone familiar with the secure introduction workflow using Hashicorp Vault? An orchestrator gets no more than a one-time use "cubbyhole" introduction token for a service that it is initializing. The initializing service uses the intro token to get actual credentials and secrets from the Vault. The orchestrator never touches any secrets: no secrets need to be passed as env variables anymore. With this setup, the person/service that seeds secrets into the Vault and the introduced system that uses the secrets are the only two that may ever touch them. Not sure how well this is actually documented but I gleamed enough from docs and a tech talk to figure the workflow out. It's pretty intuitive once you dig in.