OneCLI cannot replace the principles of least privilege, key rotation, and auditing; credential lifecycle management remains the responsibility of operations