# Design the org-scoped secret and connection control plane

Type: grilling
Status: open

## Question

Which key-management, envelope-encryption, rotation, connection identity, and
runtime resolver design will implement ADR-0021's org-scoped Feishu and model
provider credentials, support one customer-owned Feishu app per tenant, and
ensure plaintext credentials never reach business records, logs, or agent
tools?