AccessSecret is that credential's confidential half, returned ONCE — on the response that mints it and never again. IAM keeps only its argon2id digest and blanks the plaintext, so this is the single moment it exists in a form its owner can read; a replay of the same provision re-reveals nothing.
Additional is true when the caller already had an organization and this one was created WITHOUT moving them into it — they reach it via the org switcher.