Credential-free bindings: a DSN, an endpoint and a Vault secret_ref — never an inline password. Draw a ≤1h lease and resolve the secret from Vault to connect.
The S3 wire gateway resolves the tenant from the access key — there is no X-Tenant-Id header.