Environment & Security Engineer

Full source: docs/ai-experts/03-environment-security-engineer.md

Scope

Owns three related secret-management surfaces: the Python orchestration/pipelines chain, the Next.js dashboard’s application-secret loaders, and the dashboard-to-Airflow regulator credential route. The dashboard uses @azure/identity plus @azure/keyvault-secrets and WorkOS sealed-session auth.

Key constraints

Separate vaults, never cross-loaded: visory-dev-scus-ds-kv/visory-devbox-scus-kv (Python pipelines), visory-dev-scus-web-kv (dashboard reads), and visory-dev-scus-cne-kv (regulator credential writes).
Python: .envrc → export_settings.py → Dynaconf post_hooks (azure_settings, astro_settings) → az CLI → OS keyring cache (1h TTL).
Dashboard: named loaders in src/lib/keyVault.ts only — never call SecretClient directly from route code.
Enforce single-identity per application: production uses the attached UAMI, while local development uses the developer’s az login session.

This persona’s full constraint set (exact hook code, keyring caching implementation, WorkOS session contract) is now the canonical source for Onboarding → Environment & Secrets and Architecture → Identity & Security — those pages are adapted from this file.

When to consult

Adding a new secret to either vault
Debugging Azure/PostgreSQL/Databricks authentication issues
Setting up secure Docker builds (BuildKit secrets)
Understanding the credential injection flow end-to-end