Resolved secrets win over matching
env keys. Parameter values map to PARAM_<UPPER_KEY> and optional envVar; explicit runtime environment values can override those mappings. Unknown supplied parameters and invalid required/option/pattern values fail incremental validation.
Generated credential defaults use CRED_<UPPER_KEY> unless envVar is declared. App environment metadata is readable by authorized callers; these declarations are not an encrypted secrets vault.
See environment, secrets, parameters, and managed AI for workflows.