# Design the org-scoped secret and connection control plane

Type: grilling
Status: resolved

## Question

Which key-management, envelope-encryption, rotation, connection identity, and
runtime resolver design will implement ADR-0021's org-scoped Feishu and model
provider credentials; support one customer-owned Feishu app per Organization;
support Organization-managed BYOK and a distinct platform-managed provider
connection per Organization; and ensure plaintext credentials never reach
business records, logs, or agent tools?

## Answer

Use the local master-key envelope, immutable connection-secret versions,
writer-authority split, explicit Organization/Project resolver, staged KEK
rotation, and separately protected keyring recovery contract accepted in
ADR-0024. Production receives the root-owned keyring only through systemd
`LoadCredential`; it has no process-global credential fallback. Agent runs use
a loopback proxy capability rather than the Organization Provider credential;
the offline rotation command atomically retains old/new KEKs, rewraps stored
DEKs, audits the changes, and authenticates the complete envelope set.
