Every provider, LLM, STT, TTS, or telephony, is configured per tenant with one of three policies.
TENANT_OWNED means the tenant supplies encrypted credentials and pays the provider directly. PLATFORM_SHARED means the tenant uses a platform-owned account, ideal for agencies onboarding clients fast. DISABLED simply turns a provider off for that tenant.
Credentials resolve dynamically at call time, so a single engine replica can serve many tenants without any global secrets or env-var sprawl.