Lattices can have secrets. They are managed via API and cmdline (get/set).
Top-level Systems can define $parameters that are unbound. When defined they must be bound by passing values to systems:create.
We define a syntax to pass Lattice-level secrets as parameter values to systems:create. What is passed into the system is the secret thunk pointing to the Lattice-level secret.
Sounds like this is hard and that practically we will have to copy the value. We could consider copying during every deploy to make it easier to realize changed values for lattice-level secrets.
We want to validate we have all the secrets we need when we deploy
Original design doc:
https://docs.google.com/document/d/1tPQvoZL5FybpWC2Ps0zzSmB1wfZMocJRvJJ6pQoJPB8/edit
There we also discuss the idea of Lattice-user-level secrets and Cloud Lattice account-level / user secrets.