a WorkflowDefinition (the Workflow-analog) applies a SecretHandlingPolicy that governs how secrets (API keys, credentials) are handled across the workflow / run / harness
| from | to | to kind |
|---|---|---|
| workflow:linear-default | secret-handling:no-secrets-in-prompts | SecretHandlingPolicy |
| workflow:linear-default | secret-handling:explicit-injection | SecretHandlingPolicy |
| workflow:linear-default | secret-handling:redact-in-logs | SecretHandlingPolicy |