And yet a lot of unix tools also have a -q quiet mode to not output anything unless an error.

cron adopts this philosophy in that you get an email if there is any output at all.

There is a tool called chronic which you can use as a wrapper which captures stdout and only ouput if the return code is an error:

  $ chronic vault kv undelete -versions=2 secret/my-secret
  $