ADR-029: Connector Identity Model — Phased (broker interface fixed, provider hardens)
The connector credential-identity model is phased: the broker INTERFACE is fixed, the PROVIDER hardens over time. Env-broker (all tenant secrets in the VM env) is dev/demo only. The per-tenant Azure Key Vault broker is the LANDED production store. Federation (assume-role, multi-tenant app + admin consent, WIF) is the endgame where no long-lived secret is exchanged — the same broker interface mints a token instead of fetching a secret. Records why each connector defaults to the simplest-terminal identity model, so connectors landing in the meantime do not quietly default to per-tenant secret storage.