Sensitive Data Encryption — Module Design and Migration Retrospective
A retrospective on column-level encryption of sensitive data in a running service. Envelope encryption, DEK granularity decisions, the WHERE clause constraint that led to HMAC, and the migration automation Skill that spread the work across the org.