Human Identity and Workload Identity Should Not Share an Auth Method
OIDC fits interactive operators; AppRole fits non-interactive services. Combining them weakens both lifecycle models.
AppRole
AppRole Is Machine Identity, Not a Shared Master Password
Workloads should authenticate to the secret authority with narrow machine identities rather than one credential copied across services.