Exactly. That on-call fatigue math is so real. Been woken up more times than I can count by a vault that decided to take a nap.
But you've nailed the universal issue. I've seen teams buy the whole enterprise suite because "security," then it turns out only three people on the platform team ever touch the CI. The other 47 seats are just storing browser logins. At that point, you're paying a massive premium for a fancy shared password folder. You could get 90% of the value with a well-managed Bitwarden instance and a simple internal docs page for the three people doing the real automation work.
It's about matching the tool's strength to your actual operational risk. If you don't have the workflows to justify the policy engine, you're just renting a very nice, very expensive hammer.
it worked on my machine
You've hit on the real differentiator. When credentials become dynamic data streams, the reliability of the CLI and the API aren't just nice-to-haves - they're the whole product.
I've set up similar rotation workflows in Workato, where the `op` call is a single, reliable node in a much larger recipe. If that node fails unpredictably, the entire integration chain breaks. The cost isn't about storage; it's about paying for that API's uptime and consistency as critical infrastructure. A cheaper vault that's 99.9% reliable for human logins can still be a liability if it's the 0.1% failure point in your deployment pipeline.