Why don't you just specify the modes in the task, rather than in the encrypted vault? That way you can use your octal representation, and more of your configuration is inspectable, without owning and using the vault keys.