A permits Oracle Function needs only the current database password at runtime. Which Vault operation should the Function call?

A permits Function that only needs the live database password should call the Secrets retrieval (get secret bundle) path. The bundle returns the secret contents together with version information and rotation metadata so the Function can use the password and, if needed, know which generation it received. That is a data-plane read of an existing secret, not a management-plane redesign of how the secret is governed, and it matches invoke-time credential use for a short-lived Function process.

A management-plane update that rewrites rotation rules before each invoke is the wrong plane and wrong frequency: rotation policy belongs to operators during lifecycle changes, not to every cold or warm invoke. Creating a new secret OCID on every cold start abandons the stable-secret model, multiplies orphaned secrets, and still does not explain how the Function obtains the municipal password it already should share. Associating a KMS key delegate and pasting a plaintext data encryption key into Function config confuses envelope encryption of storage with secret retrieval and recreates the anti-pattern of embedding material in config.

Exam caveat: retrieval still requires IAM read rights for the Function’s principal on the secret or secret-family scope; a successful SDK call shape without policy yields authorization errors, not an empty password. Operational check: from a non-production permits Function using resource principal, retrieve the bundle once, confirm contents and version/rotation fields are populated, and ensure the Function never logs the plaintext password while still recording version number for audit.