The key criterion for verifying whether a credential vault is effective is this: when an agent uses a secret, the value does not appear in the conversation record; if it does, the vault is merely decoration.