A per-firm credential proxy

Three processes, and the key exists in plaintext in only one of them. The agent runtime builds the tool with the firm from the verified session and signs every request with a platform secret; the proxy checks the signature, the method and path, looks up the firm's key and attaches it; the provider sees an ordinary authenticated request. The decision that matters most is that the firm is a signed claim, not a header value: without the HMAC, anything that can reach the proxy could name any firm and spend its account.