DEPLOYMENT ARCHITECTURES

CONFIGURATION, SECRETS, AND ENVIRONMENT MANAGEMENT Configuration is the set of settings that control how the system behaves, such as which model to use, token limits, and timeouts. Good practice keeps configuration out of the code, so it can be changed without rewriting the program. A secret is a sensitive value like an API key, a password, or a database credential. Secrets must never be written into source code, shared in chat, or stored in plain text files that others can read. Instead, use a secrets manager, a secure service that stores secrets, controls who can read them, records access, and allows them to be rotated, meaning replaced with new values on a schedule or after any suspected leak. An environment is a separate copy of the system used for a particular stage. Common environments are development, where builders experiment; staging, a close copy of production used for final testing; and production, the live one. Each environment has its own configuration and its own secrets. This separation is a safety feature. A test key used in development should be unable to touch real customer data in production, because production uses a different key stored in a different place. Other good habits include using the least privilege principle for each key, never reusing a production secret in tests, checking that configuration is valid at startup, and keeping a record of what configuration was active when each run happened, so that behavior can be traced later.