Municipal CI secrets for parks, clerk, and public health must stay isolated. Which vault design supports that?

Namespaced vault paths segregate municipal CI secrets so each department reads only the credentials it is authorized to use. Parks, clerk, and public-health pipelines should bind to department-scoped paths with least-privilege policies rather than sharing a universal secret namespace. The correct design works because civic automation often spans multiple agencies with different data classifications and vendors; path-level isolation limits blast radius when a pipeline identity is compromised and makes access reviews meaningful per department.

One shared root token emailed to every department with full read access fails because a root token is the master key—email distribution guarantees leakage, and full read collapses every boundary the vault was meant to enforce. A single flat secret named "password" readable by all city pipelines fails conceptually: flat shared secrets provide no attribution, no rotation granularity, and no departmental isolation. Committing each department's secrets into the same public documentation repo fails because documentation repos are not secret stores; they are replicated, searchable, and often broadly readable.

Exam caveat: namespaces alone are insufficient without identity binding—each pipeline must authenticate as a distinct role mapped to its path, and broken path ACLs can still allow cross-department reads. Operational check: authenticate as the parks CI role and confirm it can read parks secrets but is denied clerk and public-health paths; repeat for each department; rotate any historically shared tokens; and ensure no root token is used by routine municipal pipelines.