A deploy job that decrypts secrets for any push makes the encryption decorative. Hold the key in a deployment environment restricted to the default branch, and let a branch ruleset decide what reaches that branch.
A shared MLflow server answers every unconfigured question with its default grant. Setting that default to nothing and granting on purpose keeps every user's own work, and the resolution order shows what each kind of user keeps.