Align path and fields (API_KEY, API_USER) with provisioned secret; policy and OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.
Policy + OIDC role for tenants/binky/qonto/api; agent-high-risk-boundary deny on data path. Implements DEC-2026-004 / BINKY-WP-0005 custody; secret values remain founder Red-lane.