An information handling system comprising: a host system comprising a host system processor ; a management controller communicatively coupled to the host system processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, the management controller comprising: a management controller processor ; and a credential vault communicatively coupled to the management controller processor and configured to store a first set of secrets associated with the information handling system, wherein the first set of secrets are accessible in response to a hardware-verified boot of the management controller; and a cryptoprocessor communicatively coupled to and owned by the management controller processor , the cryptoprocessor comprising a storage configured to store a second set of secrets that comprises credentials for performing particular management functions not enabled by the first set of secrets, wherein the second set of secrets is associated with the information handling system such that access to the second set of secrets may be granted in response to an administrator's provision of a verified authorization to the cryptoprocessor, and such that access to the second set of secrets is prevented during runtime of the host system if the verified authorization is not present. a host system comprising a host system processor ; a management controller communicatively coupled to the host system processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, the management controller comprising: a management controller processor ; and a credential vault communicatively coupled to the management controller processor and configured to store a first set of secrets associated with the information handling system, wherein the first set of secrets are accessible in response to a hardware-verified boot of the management controller; and a management controller processor ; and a credential vault communicatively coupled to the management controller processor and configured to store a first set of secrets associated with the information handling system, wherein the first set of secrets are accessible in response to a hardware-verified boot of the management controller; and a cryptoprocessor communicatively coupled to and owned by the management controller processor , the cryptoprocessor comprising a storage configured to store a second set of secrets that comprises credentials for performing particular management functions not enabled by the first set of secrets, wherein the second set of secrets is associated with the information handling system such that access to the second set of secrets may be granted in response to an administrator's provision of a verified authorization to the cryptoprocessor, and such that access to the second set of secrets is prevented during runtime of the host system if the verified authorization is not present. <EOS>