That’s an ideal solution, but projects often end up with at least some services that don’t support this. Also, even where multi-account access is supported, when it comes to the organization as a whole maintaining access to key services for all projects, it is unfortunately far more practical to have an org-level services email account that every project just knows to invite to everything and submits a randomized password to the org-level password store
We’ve been using bitwarden_rs at Code for Philly for a couple months now and I’m happy with it, I had a draft topic about it I forgot to post: