A tenant hands you their Anthropic key. From that moment you are holding a credential that can spend their money, and every place it lands is a place it can leak.
Envelope encryption with a per-tenant context is the shape: the key is sealed on write, the wrapping key never leaves the KMS, and the plaintext exists only inside a callback that lasts one request.
The parts people skip are the boring ones. `toJSON()` throws. `toString()` returns a mask. The resolved cache is in-process and never Redis, because Redis persists to disk, replicates over a network, and shows up in `MONITOR`.
A cold instance paying one KMS decrypt is the price, and it is a good price.
