HI Dan Collins,
The Q2 vault add cli tool is sufficient for development. development env is actually using filesystem in local dir to store and retrive vault data. comming to stg/prod a real datacenter environment, the Vault service will be running and serving these secrets.
In stg/prod we need to request Q2 team to add secrets in vault because Q2 vault add adds only in devlopment env.

vault also provides access based on institution level and each environment level.

Thanks,
swarup
www.nuevesolutions.com