Status: OUT
Both AKS and App Service achieve fully network-isolated secret injection through the same underlying Azure platform stack (Key Vault defense-in-depth + Private Link triple isolation + managed identity + NSG default-deny), proving the secret isolation pattern is compute-platform-independent.