Most secrets tools imply something they cannot deliver: that removing someone's access takes back what they knew. It does not. If a colleague read the production database password last Tuesday, revoking their access today does not remove it from their memory, their notes, or the clone of the repository on their laptop.
Removing access does not undo past reads
Removing access stops future reads. It does not undo past ones. The only real revocation is changing the secret value itself.
This is true of every secrets manager ever built, including the expensive ones. The tooling here is built around it: when you remove someone, you get a checklist of the values that now need changing.
Once you accept this, a lot of design questions answer themselves. Rotation stops being a compliance chore and becomes the actual security mechanism.