Token custody

Trace the credential's path separately from the model's tool request. A model can request an action without receiving the OAuth token that authorizes it. The execution service can inject that token when it calls the provider.

Custody is different from authorization and deployment location. For a security review, establish who stores and decrypts credentials, where authenticated requests execute, and how revocation works. A private execution environment does not by itself establish that credentials remain in your infrastructure.