| After (secure) Shared database with direct queries | Tokenized, field-level encryption Static API keys | Short-lived tokens + mTLS No data minimization | Enforce least-privilege access per partner Manual audit | Automated runtime attestation
