Credential Custody Chain

Credential Custody Chain is the unbroken sequence of who holds, rotates, and can revoke every secret an agency touches on a client's behalf. It matters because a retainer relationship transfers custody of client credentials, and any gap in that chain (a shared vault, an unrotated API key, an offboarded contractor still holding access) becomes the client's breach, not just the agency's. The framework asks three questions per credential: who holds it, how it rotates, and who can prove revocation within an hour. A concrete example: Bitwarden's self-hosted vaults and event logs let an agency keep custody inside its own infrastructure while still giving clients an audit trail, whereas a shared spreadsheet of logins breaks the chain at the first contractor departure. Agencies selling security-adjacent delivery should map the chain before signing, because the client's procurement team will eventually ask for it.