A 40-person fintech team uses Copilot coding agent and Actions workflows that deploy to staging and call a payments API. Auditors require least privilege, audit trails, and no hardcoded keys. Which secrets management consideration should guide how agents and workflows run securely?

The correct consideration aligns with auditor demands because encrypted environment secrets isolate staging credentials to only the workflows and agents that need them, prevent hardcoded keys in code or logs, preserve centralized audit trails of access, and support periodic reviews to maintain least privilege as the 40-person team evolves. By contrast, organization-level encrypted secrets with audit logging describe a legitimate reuse pattern for truly shared tooling, but the concept fails here on least-privilege scoping because every repository and workflow inherits payments API access and widens blast radius beyond staging. Runtime retrieval from an external vault is an enterprise best practice for avoiding static secrets, but the concept fails here because authenticating with one long-lived shared token stored in the repository is itself a hardcoded credential with broad scope, which violates the no-hardcoded-keys and least-privilege requirements. Similarly, encrypted staging variables with scoped access sound protective, but the concept confuses configuration variables with the secrets manager, failing on protected storage because variables lack masking, encryption guarantees, and access controls required for payments credentials. On the exam, watch for cues distinguishing secret scope levels and storage types rather than choosing any encrypted or vaulted pattern that looks secure in isolation. As a practical check, confirm in Actions settings that staging workflows reference environment secrets with test keys only, that access is limited to required agents and reviewers, and that secret access events appear in durable audit logs.