# Implement the Organization connection and secret plane

Type: task
Status: open
Blocked by: none

## Question

Implement encrypted, versioned, Organization-scoped Feishu Application and
model Provider Connection records plus one resolver boundary. Support one
customer-owned Feishu app per Organization, Organization-admin-managed BYOK,
and one distinct platform-managed key/base URL per Organization; enforce which
administrator may write each mode, readiness and rotation lifecycle, runtime
resolution from Organization/Project, redacted observability, backup/key
recovery hooks, and no process-global credential fallback or plaintext leakage
into business rows, logs, HTTP responses, or agent environments.
