Ask HN: How are you accessing/caching frequently used secrets?

What does your access control look like? Once fetched or decrypted, do you protect them in-use? Does frequent access change how you do audit logging? Do you have per-customer encryption keys?