Every engine claim in your tenant — SQL, cache, vector, time-series and HTAP — provisioned through one claim-based control plane (POST /api/v1/claims).
Bindings never return an inline password — connect via the DSN and a Vault secret_ref, then draw a ≤1h lease.