A Vault policy grants transit encryption while the wrapped response workflow strips the unwrap capability from operators during a failover rehearsal

The crypto permission exists and the operational path to use it is incomplete. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.