DL-639

Compass stores secret requests, grants, and audit in tenant-scoped Postgres, stores broker values in a separate encrypted Postgres table, and permits approved redemption only by the trusted browser runtime outside agent code.

Status: Active (Matt, 2026-10-20)