Key lifecycle & policy
KMS is the governance + ops layer for keys — policy engines, lifecycle management, and custody enforcement.