Implementing Dynamic Database Secrets Rotation in Zero Trust

Act as a Vault Secrets Engine Specialist. Develop a highly technical, ruthless strategy for implementing dynamic, lease-based database credentials utilizing HashiCorp Vault's native Database Secrets Engine. The target is a highly guarded [DATABASE_ENGINE] (e.g., PostgreSQL or Oracle) instance containing PII. The resulting architecture must mathematically satisfy the rigid credential rotation mandates defined by the [COMPLIANCE_STANDARD] (e.g., PCI-DSS or SOC2). You must explicitly define the exact Vault HCL roles, write the precise, underlying SQL creation and revocation statements (`CREATE USER ...`) Vault will execute, and configure the mathematical bounds of the [TTL_DURATION] time-to-live parameter. Output a flawless Python wrapper script demonstrating exactly how the application layer must gracefully catch expiration errors and seamlessly request credential renewal from Vault without dropping active client connections.