The credential boundary

A caller can do useful work without receiving the upstream value.

Qevra puts a hosted gateway between a protected service and the Principal that needs to call it. The Principal holds time-bounded authority; the gateway holds the credential and injects it only after the request is admitted.

A Secret is bound to one exact public HTTPS origin, allowed methods, and narrow paths. The caller does not get to widen that Destination Policy. A denied request does not decrypt the Secret or dial the upstream service.

The first proof is deliberately narrow: restricted development credentials, one managed region, and private decision records. Production credentials are outside this proof-first boundary.