Deployment and runtime configuration. Provider metadata and encrypted deployment secrets are operator-managed; database/runtime changes still require a reviewed restart.