Enterprise Recovery
A controlled recovery path for business vaults, never for personal vaults.
Principle
The vault key can have an additional envelope for organizational recovery. This does not weaken password entropy but adds a cryptographic access path that must be protected.
Approvals
Use MFA, approved devices, justification, audit and ideally multiple approvers for critical recoveries.
Personal boundary
Tenant Recovery policies must never allow the organization to recover a personal vault.