Create engagements, mint one-time client intake links, and decrypt received secrets under audit.
— or use a break-glass token —