Simple definition
Ansible Vault encrypts sensitive variables and files so automation secrets need not be stored in plaintext.
Purpose and use
Ansible Vault encrypts sensitive files or values used by automation so they need not be stored directly in plaintext.
How does it work?
Content is decrypted when required using a vault identity or secret supplied to the execution process.
Example and verification
Check how the decryption secret is delivered and whether output, temporary files or logs can expose subsequently used values.
Points to watch
Encryption at rest does not automatically protect every execution trace. Keeping the vault password beside encrypted data substantially weakens protection.
In short
Vault protects selected stored data; distribution, rotation and runtime use require complementary controls.