Make the Key Vault authorization model explicit in Bicep, deploy the workload’s data-plane role, and verify secret access before a successful deployment hides a production 403.