curriculum-project-hub/.scratch/saas-production-readiness/issues/19-design-org-scoped-secret-control-plane.md

Design the org-scoped secret and connection control plane

Type: grilling Status: open

Question

Which key-management, envelope-encryption, rotation, connection identity, and runtime resolver design will implement ADR-0021's org-scoped Feishu and model provider credentials; support one customer-owned Feishu app per Organization; support Organization-managed BYOK and a distinct platform-managed provider connection per Organization; and ensure plaintext credentials never reach business records, logs, or agent tools?