Credentials from env or vault, org/platform visibility, platform-right authz, safe views, internal auth