The new/alternative secret provider is interesting:

https://github.com/bilelmoussaoui/oo7?tab=readme-ov-file

I would like to be asked when processes access my secrets, or maybe it will be possible to set perms on the portal in future.