BYOK readiness

Credential resolution boundary

V1 uses SkillRouter-managed provider credentials. Future BYOK support should resolve a credential after model and route selection, based on account policy and provider, without exposing plaintext credentials to the dashboard or model registry.

• Encrypt customer provider credentials with a managed key and scoped access.
• Store credential metadata separately from provider routes.
• Select SkillRouter-managed or customer-managed credentials through an explicit policy.
• Redact credentials from logs, errors, audit payloads, and provider request snapshots.
• Define who pays upstream and how usage is billed before enabling BYOK traffic.