I understand the need for using the Harness secret manager to avoid additional credential lookups. However, I believe there could be a workaround that doesn't require it. We could use a Vault or AWS secret manager with IAM delegate authentication, which doesn't need credential storage. This could be enforced during secret manager creation to ensure the secret manager used for credential storage doesn't require authentication credential storage. Detection could be added during secret extraction to identify multiple 'hops' and fail with a meaningful message if necessary.