As well as storing credentials in the Blue Prism Credential Manager, I suggest building password change processes for each application. The Password Change processes will simply follow the process within the application to change the password - and the new password will be generate by the Blue Prism process and saved to back to credential store.
If Blue Prism not only stores the credentials using 256bit encryption - but also has changed the credentials itself - than no human user will know the credentials and, if access to the Production environment is limited as it should be, it is impossible for anyone outside of a running blue prism session to use that credential.
