Other people's keys live behind the same wall as their containers

Every SaaS ends up holding other people's secrets: the customer's Stripe key so you can pull their charges, their Shopify token so you can sync orders. They go in a credentials table, encrypted with a key that lives next to the table.

Here the vault is a per-account key-value store with a realm dimension. You write acme's Stripe key with PUT /api/v1/vault/keys/stripe_secret under acme's realm, encrypted before it leaves your process; GET /api/v1/vault/keys?realm_id={acmeRealm} lists acme's keys and nobody else's. The customer's own token never reaches the vault: vault_access defaults to false on every token you mint. Your integration worker reads the value at run time and holds it in memory for one job.

Realm membership is already the line between customers: other people's keys sit behind the same wall as their containers.