Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part).

We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).