BYOK material is envelope-encrypted. Plaintext exists only under policy, only in memory, and every unwrap produces a customer-visible access record bound to the request and chain entry.
TaskQ stores encrypted credential material, records fingerprints, and produces access evidence. The custody service owns decrypt policy — and nothing else.
Credential values never belong in logs, chain entries, crash dumps, or UI.
Canada-only, Alberta-only, EU, customer-owned HSM, or future enclave domains.
Credential access becomes a visible proof event attached to the request.
Revoked and retired credentials stop new decrypts before placement or execution.
Gateway maps X-TaskQ-Credential to an encrypted credential record in scope.
Custody service verifies the selected worker satisfies the credential’s key domain.
Material is unwrapped in memory only, inside the approved custody class.
The unwrap becomes a customer-visible credential.access event in the chain.
A buyer should be able to ask exactly where a credential was used and receive evidence, not a verbal promise.