Broker, not store
A credential is injected only at the broker’s egress to its provider. It is never returned by any endpoint, never logged, never handed to an app. Everything outside the broker holds at most a low-value, revocable scoped token.
Envoy, the external-connection broker inside Nexus, vaults the household’s provider credentials — LLM keys, Google, Apple and Microsoft OAuth — and is the sole egress to those providers. Consumers present a scoped token and get results back. They never get the credential.
The point generalizes past Nexus. The question to ask of any system is not “what is the policy on secrets?” but “where can a secret physically arrive?” If the answer includes a place that doesn’t need it, the architecture is wrong, and no policy fixes it.