How should secret management be designed for production?

For production, use a dedicated secret store, prefer short-lived federated credentials, scope access per workload, rotate regularly, audit retrieval, prevent logging, and separate secrets across environments. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.