Credentials live only in secret storage and are lent briefly

Context

Account configuration and secret values have different access and retention boundaries.

Decision

Store credential values in external secret storage and issue brief, execution-scoped in-memory leases to authorized adapters. Credential administration requires its own permission.

Alternatives Considered

Keep encrypted provider keys in ordinary database records. Database reads and backups would then include encrypted provider material; the existing storage boundary separates those values.

Grant key administration to every account manager. Organizations may separate account administration from replacement of provider credentials.

Consequences

Read operations expose metadata and a limited hint without secret values.

Replacement selects a new secret; seven-day recovery of the old secret depends on the external deletion request succeeding.

Database deletion alone cannot remove external credentials.