The AAP/Gateway operator creates or reads a protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and then copies the plaintext value into the generated AutomationController Custom Resource under spec.extra_settings as RESOURCE_SERVER.SECRET_KEY (alongside URL: <Gateway internal URL> and VALIDATE_HTTPS: false). This breaks the expected OpenShift RBAC separation between reading an AutomationController CR and reading the corresponding Kubernetes Secret: a principal with permission to read the Controller CR can recover the service credential without permission to read the Secret. The operator uses no_log to prevent the value from appearing in its logs, but then serializes the same value into the CR. The value may also propagate into Kubernetes API/etcd storage, Argo diffs and history, rendered GitOps artifacts, support bundles, audit data, and command output. Relevant operator code: roles/ansibleautomationplatform/tasks/initialize_gateway.yml, roles/ansibleautomationplatform/tasks/inject_gw_settings_in_controller.yml, roles/ansibleautomationplatform/vars/main.yml. Confirmed in build aap-operator.v2.6.0-0.1792661545; likely all AAP versions since the introduction of the gateway operator (AAP 2.5). The value is intended for trusted Gateway-to-Controller service authentication; a user who can read the Controller CR may be able to impersonate a trusted Controller service and access privileged service-index APIs. Depending on the service authorization policy, potential impact includes reading protected service-index data, creating or modifying role assignments, modifying RBAC-related resources, and escalating AAP user privileges potentially to superuser-equivalent actions.