# Credential security

> Security guarantees and operator responsibilities for storage, use, lifecycle state, logs, and tenant isolation.

Constal treats Credential material as opaque governed data. Platform code manages encryption, lifecycle, authorization, and audit boundaries; tenant Drivers receive material only for an authorized operation.

## Storage {#storage}

- Every version is encrypted with a data key and purpose-bound authenticated identity.
- Provider-private lifecycle state is encrypted separately from consumer material.
- Fingerprints are keyed and cannot reconstruct material.
- Resource documents, deployment manifests, provider configuration, and binding records contain references and hashes, not plaintext.

## Use boundary {#use-boundary}

The Resource Broker evaluates `credential:use` against the authenticated authority, exact Credential, attached Policies, and binding context. A Driver receives only slots declared by its Resource. Agent code, prompts, Channel code, and ordinary Resource metadata do not receive secret values.

## Isolation {#isolation}

- Provider setup and Credential creation are namespace-bound.
- Existing bootstrap Credentials must belong to the authenticated tenant boundary.
- Scoped resolution derives tenant, customer, or principal from authenticated authority.
- Narrow scopes never fall back to broader assignments.
- Runs pin exact targets and resolution evidence.

## Logs, analytics, and audit {#logs-and-analytics}

Never emit material, authorization codes, refresh tokens, client secrets, private keys, PKCE verifiers, or provider-private state. Audit events should record operation identity, Credential CRN, version, fingerprint, outcome, expiry, and external non-secret identifiers only.

Redact secret-shaped input before error reporting. Treat upstream response bodies as sensitive unless the provider protocol explicitly extracts a bounded safe message.

## Operator responsibilities {#operator-responsibilities}

- Request the minimum external permissions.
- Use customer or principal scope whenever authority differs by owner.
- Rotate bootstrap application secrets according to external policy.
- Disable bindings for reversible pauses and revoke compromised material promptly.
- Review provider egress origins and methods before installation.
- Keep provider documentation and external permission requirements current.

## Provider responsibilities {#provider-responsibilities}

Provider authors must declare exact egress, classify uncertain outcomes conservatively, validate external responses, return bounded expiry, keep refresh state private, and implement destruction when the upstream service supports revocation.