Which practice most reduces blast radius if one application is compromised?
- A One vault for the whole organisation
- B Separate vaults per application and environment with scoped role assignments (correct answer)
- C Sharing one identity across apps
- D Disabling logging
Shortcut: Vault-per-application-per-environment means a compromised identity can reach only that vault's contents, and it simplifies both RBAC and throttling isolation.