Made by the pipeline

The encryption master key, the bootstrap and webhook secrets, the database connection string, the instance key — created idempotently, stored directly in the vault.

Made by a person

The sign-in application's secret and the operations App's private key: registering an identity provider is a browser act. Vault write for that step is granted, used and removed.

Nobody else

The vault is role-based: the pipeline identity writes, the portal identity reads. A person listing it is refused — which is the design, not a misconfiguration.