MetaData is global across all providers and unencrypted at the holonic layer. For holons that carry sensitive state (e.g. API keys, personal data stored in agent memory), what's the recommended pattern? Encrypt before writing into MetaData, use a provider with at-rest encryption, store sensitive data in child holons with restricted access — or something else?