Automating decryption means you have to store the passphrase somewhere, or not use a passphrase (unless you use additional options as pointed out in the other answer submitted by Stephen while I was typing mine)! Neither of those match your requirement for good or great security standards.
i.e. your requirement is not compatible with it being secure.
You can rely on things like - you have to be root, I've given the file in which my passphrase is stored a really confusing name, I've encrypted the underlying file systems, etc., etc. but they're all layers which are trivial to circumvent once you are root in the first place.
The option which prevents the passphrase showing up in the process list is
However, that's no more secure than just removing the passphrase in the first place.