Secrets boundary
Per-record envelope encryption; production KEKs live outside the database. The web application and billing worker cannot bulk-decrypt credentials.
Security model
Assume every boundary will eventually be tested.
The architecture limits what each workload can read, what each credential can call, and what the platform can safely do when evidence is incomplete.
Tenant isolation
Row-level security, workload-specific database roles, default-deny grants, and explicit negative tests for browser, RPC, and view access.
Controlled egress
Provider endpoints come from an approved registry. Redirects, private networks, metadata endpoints, and arbitrary upstream URLs are rejected.
Accounting integrity
Quota and funds are reserved atomically before dispatch. Unknown upstream outcomes enter reconciliation instead of becoming free usage.
Sensitive-action MFA
Credential changes, payout details, withdrawals, and administrative approvals require recent AAL2 verification and audit context.
An explicit trust boundary
The gateway must briefly handle a plaintext supplier key in memory to call an upstream provider. This is not zero-knowledge infrastructure. Plaintext is never persisted or returned, and supplier dashboards never receive consumer prompts.