The way we thought about it is from the lense of 2 personas: - a persona that control the control plain side, what secret to distribute to which user and what hosts they are allowed to send that secret to (probably platform team or secops team) - a persona that represent the user that need to reach host X with secret Y (probably the dev team)

based on this secret rewrite signal need to be out of band and not part of the request it self or the whole model will fall apart.

We already have the intention to support rewrites for specific headers but those headers are defined by the first persona out of band too.

btw, we support rewrite for postgres protocol for db password.