platform-encryption-configure

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Configure Platform Encryption

配置Platform Encryption

Configures Salesforce Shield Platform Encryption by generating the metadata that turns it on and choosing the right settings: which encryption scheme a field should use, which key-management model fits a requirement, and how the tenant-secret lifecycle works. This is a hybrid skill — it emits deployable

*.settings-meta.xml

*.field-meta.xml

where Platform Encryption exposes a real Metadata API surface, and returns grounded guidance where the operation is UI/REST-only.

通过生成启用它的元数据并选择合适的设置来配置Salesforce Shield Platform Encryption：包括字段应使用的加密方案、符合需求的密钥管理模型，以及租户密钥生命周期的运作方式。这是一个混合技能——当Platform Encryption提供真实Metadata API接口时，它会生成可部署的

*.settings-meta.xml

*.field-meta.xml

文件；当操作仅支持UI/REST时，它会返回基于实际情况的指导。

Scope

适用范围

In scope: choosing and applying
```
encryptionScheme
```
on a field; enabling deterministic encryption, Cache-Only Keys, External Key Management, and replay detection via
```
PlatformEncryptionSettings
```
/
```
EncryptionKeySettings
```
; explaining BYOK / BYOKMS / EKM / Cache-Only key models; tenant-secret rotation and destruction semantics; the query behavior of encrypted fields.
Out of scope: a plain custom field with no encryption (use
```
platform-custom-field-generate
```
); the raw Metadata API field reference (use
```
platform-metadata-api-context-get
```
); Classic Encryption (
```
EncryptedText
```
fields) — that is a separate, legacy feature; deploying/pushing metadata to an org (that belongs to a deploy lifecycle skill).

包含范围：为字段选择并应用
```
encryptionScheme
```
；通过
```
PlatformEncryptionSettings
```
/
```
EncryptionKeySettings
```
启用确定性加密、仅缓存密钥、外部密钥管理和重放检测；解释BYOK/BYOKMS/EKM/仅缓存密钥模型；租户密钥轮换和销毁的语义；加密字段的查询行为。
排除范围：无加密的普通自定义字段（请使用
```
platform-custom-field-generate
```
）；原始Metadata API字段参考（请使用
```
platform-metadata-api-context-get
```
）；Classic Encryption（
```
EncryptedText
```
字段）——这是一个独立的旧版功能；将元数据部署/推送到组织（属于部署生命周期技能的范畴）。

Required Inputs

必要输入

Gather or infer before proceeding:

Question type: is the user asking for a deployable artifact (a settings file, an encrypted field) or guidance (which model, what happens when I rotate a key)? Deployable → generate XML from
```
assets/
```
. Guidance → answer from
```
references/
```
. A question is guidance whenever the ask is to explain, confirm, or compare — "is that right?", "what's the relationship?", "can we…?", "is there an ordering requirement?", "explain the difference between X and Y", "which key model should we use?" — even if the user also says they are about to write, deploy, or author settings themselves. The user writing settings is their action; it does not make the skill's deliverable a file. Only an explicit "generate / create / give me the file / here is my field, encrypt it" is an artifact request.
Key-model choice questions are guidance, not deployable metadata. "Explain BYOK vs external key management / BYOKMS / EKM / Cache-Only", "which one keeps key material out of Salesforce?", "should we use BYOK or EKM?" → answer them in a single markdown answer file (the guidance write-up), not a deployable
```
*.settings-meta.xml
```
. Naming the enabling setting in that answer (e.g.
canExternalKeyManagement
,
enableCacheOnlyKeys
) does NOT turn it into a settings artifact — cite the field name inline in the answer file; do not emit an
```
EncryptionKey.settings-meta.xml
```
unless the user explicitly says "generate/create the settings file."
Field encryption target (for field work): the object and field API name, and whether the user needs to filter, sort, or group on the field (drives deterministic vs probabilistic).
Key model (for key work): whether keys are Salesforce-derived (default), customer-supplied (BYOK), stored in an external KMS (BYOKMS/EKM), or fetched on demand (Cache-Only).

If the request is clear, generate or answer immediately — do not interrogate the user.

在执行前需收集或推断：

问题类型：用户是请求可部署工件（设置文件、加密字段）还是指导建议（选择哪种模型、密钥轮换会发生什么）？如果是可部署工件→从
```
assets/
```
生成XML；如果是指导建议→从
```
references/
```
获取答案。只要用户的问题是解释、确认或比较类的，即为指导建议——比如“这样对吗？”、“两者关系是什么？”、“我们能否……？”、“有没有顺序要求？”、“解释X和Y的区别”、“我们应该使用哪种密钥模型？”——即使用户同时提到他们即将编写、部署或创建设置文件。用户编写设置是他们的操作，并不意味着技能的交付物是文件。只有明确要求“生成/创建/给我文件/这是我的字段，请加密它”时，才属于工件请求。
密钥模型选择类问题属于指导建议，而非可部署元数据。“解释BYOK与外部密钥管理/BYOKMS/EKM/仅缓存密钥的区别”、“哪种模型能让密钥材料不存储在Salesforce中？”、“我们应该使用BYOK还是EKM？”→用单个Markdown答案文件（指导文档）回答，而非可部署的
```
*.settings-meta.xml
```
文件。在答案中提及启用设置（如
canExternalKeyManagement
、
enableCacheOnlyKeys
）并不等同于生成设置工件——在答案文件中内联引用字段名称即可；除非用户明确要求“生成/创建设置文件”，否则不要生成
```
EncryptionKey.settings-meta.xml
```
。
字段加密目标（针对字段操作）：对象和字段API名称，以及用户是否需要对该字段进行筛选、排序或分组（这会决定使用确定性还是概率性加密）。
密钥模型（针对密钥操作）：密钥是Salesforce派生（默认）、客户提供（BYOK）、存储在外部KMS（BYOKMS/EKM）还是按需获取（仅缓存）。

如果请求明确，立即生成或回答——无需询问用户。

Workflow

工作流程

Classify the request — deployable artifact vs guidance, using the Required Inputs above. Then scope the output to exactly what was asked:
- A guidance question produces exactly one markdown answer file — a single file (e.g.
```
answer.md
```
  ) containing the full written diagnosis/explanation — and nothing else. Do not also emit a
```
*.settings-meta.xml
```
  , a
```
*.field-meta.xml
```
  , or a second helper doc. This covers every "what happens when…?", "how do I…?", "which model…?", "is X right…?", "can we…?", "what's the relationship / ordering…?" question, including query-behavior and Cache-Only/replay questions. A clause like "before I write our settings" or "before I author the file" describes the user's next step and does NOT turn the question into a deployable-metadata request — write the answer file, not a settings file.
- Naming a metadata change in a guidance answer does NOT mean emitting the deployable file for it. A remediation or diagnosis question — "how do I make the field queryable?", "why did my query fail and how do I fix it?", "which key model keeps material out of Salesforce?" — is answered inside the one markdown answer file, naming the relevant element/scheme inline (e.g. "switch to a
```
Deterministic*
```
  scheme and enable
```
enableDeterministicEncryption
```
  ", or "use External Key Management —
```
canExternalKeyManagement
```
  "). Do not additionally materialize a
```
*.field-meta.xml
```
  or
```
*.settings-meta.xml
```
  to demonstrate that change — mentioning the element in the answer is the complete deliverable. Produce a deployable metadata file only when the user explicitly says generate/create/give me the field or settings file.
- An artifact request gets only the specific metadata file(s) named — do not add a
```
DEPLOYMENT_GUIDE.md
```
  ,
```
README.md
```
  , an
```
EXPLANATION.md
```
  , an org-
```
settings
```
  file, or any companion artifact the user did not ask for.
- If a deploy step or org setting is a prerequisite, state it inside the one answer file (for guidance) or in a code comment inside the one artifact (for an artifact request) — never as an extra file.
For field encryption — read
```
references/encryption-schemes.md
```
to choose the scheme, then load
```
assets/encrypted-field.field-meta.xml
```
as the starting template. Set
```
encryptionScheme
```
to exactly one of the four valid enum values (see the reference). Only
```
Deterministic*
```
schemes are filterable.
Write the field file at the SFDX source path, not the root. A
```
*.field-meta.xml
```
must live at
```
objects/<ObjectApiName>/fields/<FieldApiName>__c.field-meta.xml
```
(e.g.
```
objects/Patient__c/fields/Diagnosis_Notes__c.field-meta.xml
```
) — the object folder uses the object's API name (
```
Patient__c
```
for a custom object,
```
Contact
```
for a standard one) and the file is named after the field API name. Emitting the file at the repo root, in a flat directory, or under any other folder is a structural miss even when the XML itself is correct.
For org-level encryption settings — load
```
assets/PlatformEncryption.settings-meta.xml
```
(deterministic encryption, field-history encryption, MEK permission) or
```
assets/EncryptionKey.settings-meta.xml
```
(Cache-Only, EKM, Data 360, transactional DB, replay detection). Read
```
references/key-models.md
```
before setting any key-model field.
Name the output file after the Settings member, not the root element, and write it under
settings/
. A
```
Settings
```
file must be
```
settings/<member>.settings-meta.xml
```
, where
```
<member>
```
is the org's metadata member name — EncryptionKey
(root
```
<EncryptionKeySettings>
```
) and PlatformEncryption
(root
```
<PlatformEncryptionSettings>
```
). Put it in the
```
settings/
```
source folder (e.g.
```
settings/EncryptionKey.settings-meta.xml
```
), not the repo root. Naming the key-settings file
```
Encryption.settings-meta.xml
```
or
```
EncryptionKeySettings.settings-meta.xml
```
fails deployment with "The object '…' of type Settings metadata does not exist."
Cache-Only Keys and replay detection are a one-way dependency, not an auto-enable. You may set
```
enableReplayDetection
```
only after
```
enableCacheOnlyKeys
```
is
```
true
```
; enabling Cache-Only does not turn replay detection on by itself. An org can validly run Cache-Only with replay detection off.
For tenant-secret operations (rotate, destroy, BYOK upload, Cache-Only callout setup) — read
```
references/tenant-secret-lifecycle.md
```
. These are UI/REST-only; capture the guidance in the single markdown answer file, not a deployable metadata file.
Validate any generated settings XML — run
```
scripts/validate-encryption-metadata.sh
```
with the file path as its argument, and fix anything it reports. It checks the replay-detection dependency and the
```
encryptionScheme
```
enum deterministically.
Compare against the worked example — verify a generated
```
EncryptionKeySettings
```
file against
```
examples/cache-only-keys.settings-meta.xml
```
.

分类请求——根据上述必要输入，判断是可部署工件还是指导建议。然后严格按照请求内容生成输出：
- 指导建议类问题仅生成一个Markdown答案文件——单个文件（如
```
answer.md
```
  ）包含完整的诊断/解释内容——无其他内容。不要同时生成
```
*.settings-meta.xml
```
  、
```
*.field-meta.xml
```
  或辅助文档。这涵盖所有“当……时会发生什么？”、“我该如何……？”、“哪种模型……？”、“X是否正确……？”、“我们能否……？”、“关系/顺序是什么……？”问题，包括查询行为和仅缓存密钥/重放检测相关问题。诸如“在我编写设置之前”或“在我创建文件之前”的表述描述的是用户的下一步操作，并不将问题转化为可部署元数据请求——应编写答案文件，而非设置文件。
- 在指导建议答案中提及元数据变更并不意味着要生成对应的可部署文件。修复或诊断类问题——“我该如何让字段可查询？”、“我的查询为什么失败，该如何修复？”、“哪种密钥模型能让材料不存储在Salesforce中？”——都应在单个Markdown答案文件中回答，内联提及相关元素/方案（如“切换到
```
Deterministic*
```
  方案并启用
```
enableDeterministicEncryption
```
  ”，或“使用外部密钥管理——
```
canExternalKeyManagement
```
  ”）。不要额外生成
```
*.field-meta.xml
```
  或
```
*.settings-meta.xml
```
  来演示该变更——在答案中提及元素即为完整交付物。仅当用户明确要求生成/创建/提供字段或设置文件时，才生成可部署元数据文件。
- 工件请求仅生成用户指定的特定元数据文件——不要添加
```
DEPLOYMENT_GUIDE.md
```
  、
```
README.md
```
  、
```
EXPLANATION.md
```
  、组织设置文件或任何用户未请求的辅助工件。
- 如果部署步骤或组织设置是前提条件，应在指导建议的单个答案文件中说明，或在工件请求的单个工件的代码注释中说明——绝不作为额外文件提供。
字段加密操作——阅读
```
references/encryption-schemes.md
```
选择方案，然后加载
```
assets/encrypted-field.field-meta.xml
```
作为起始模板。将
```
encryptionScheme
```
设置为四个有效枚举值之一（请参考文档）。只有
```
Deterministic*
```
方案支持筛选。
将字段文件写入SFDX源路径，而非根目录。
```
*.field-meta.xml
```
文件必须存放在
```
objects/<ObjectApiName>/fields/<FieldApiName>__c.field-meta.xml
```
路径下（例如
```
objects/Patient__c/fields/Diagnosis_Notes__c.field-meta.xml
```
）——对象文件夹使用对象的API名称（自定义对象为
```
Patient__c
```
，标准对象为
```
Contact
```
），文件名称与字段API名称一致。即使XML内容正确，将文件放在仓库根目录、扁平目录或其他文件夹下也属于结构错误。
组织级加密设置操作——加载
```
assets/PlatformEncryption.settings-meta.xml
```
（确定性加密、字段历史加密、MEK权限）或
```
assets/EncryptionKey.settings-meta.xml
```
（仅缓存密钥、EKM、Data 360、事务型数据库、重放检测）。在设置任何密钥模型字段之前，阅读
```
references/key-models.md
```
。
输出文件以Settings成员命名，而非根元素，并写入
settings/
目录。Settings文件必须命名为
```
settings/<member>.settings-meta.xml
```
，其中
```
<member>
```
是组织的元数据成员名称——EncryptionKey
（根元素
```
<EncryptionKeySettings>
```
）和**
```
PlatformEncryption
```
**（根元素
```
<PlatformEncryptionSettings>
```
）。将文件放在
```
settings/
```
源文件夹下（例如
```
settings/EncryptionKey.settings-meta.xml
```
），而非仓库根目录。将密钥设置文件命名为
```
Encryption.settings-meta.xml
```
或
```
EncryptionKeySettings.settings-meta.xml
```
会导致部署失败，错误信息为*“类型为Settings的对象'…'不存在。”*
仅缓存密钥和重放检测是单向依赖关系，而非自动启用。只有当
```
enableCacheOnlyKeys
```
设为
```
true
```
后，才能设置
```
enableReplayDetection
```
；启用仅缓存密钥并不会自动开启重放检测。组织可以在仅缓存密钥启用的情况下关闭重放检测，这是有效的配置。
租户密钥操作（轮换、销毁、BYOK上传、仅缓存密钥调用设置）——阅读
```
references/tenant-secret-lifecycle.md
```
。这些操作仅支持UI/REST；将指导内容写入单个Markdown答案文件，而非可部署元数据文件。
验证生成的设置XML——运行
```
scripts/validate-encryption-metadata.sh
```
并传入文件路径，修复所有检测到的问题。该脚本会检查重放检测依赖关系和
```
encryptionScheme
```
枚举的确定性。

与示例对比——将生成的

EncryptionKeySettings

文件与

examples/cache-only-keys.settings-meta.xml

进行验证。

Rules / Constraints

规则/约束

Constraint	Rationale
`encryptionScheme` must be exactly one of `CaseInsensitiveDeterministicEncryption` , `CaseSensitiveDeterministicEncryption` , `None` , `ProbabilisticEncryption`	These are the only values the Metadata API accepts ( `CustomField` , API 44.0+); any other string fails deployment.
Set `enableReplayDetection` only when `enableCacheOnlyKeys` is `true`	The contract is "Requires enableCacheOnlyKeys=true before setting enableReplayDetection to true" — a one-way dependency.
Use deterministic schemes only when the field must be filtered, sorted, or grouped	Probabilistic is stronger but non-filterable; deterministic trades some cryptographic strength for queryability.
Never claim a filter/sort/group on a probabilistically-encrypted field silently returns zero rows	The platform rejects the query with `INVALID_FIELD` (see gotchas); telling the user it "returns nothing" is factually wrong.
Do not emit `enableExternalKeyManagement` — the field is `canExternalKeyManagement`	The WSDL element is `canExternalKeyManagement` ; the sample in some docs uses a non-existent element name.
Transactional-DB, EKM, and Data 360 key fields require API 63.0+	`canEncryptTransactionalDatabase` , `canExternalKeyManagement` , `canManageDataCloudKeys` were introduced in 63.0.
A guidance question produces exactly one markdown answer file — never a deployable `.settings-meta.xml` / `.field-meta.xml` , and never a second doc	The answer file is the user's reference document — it persists in the workspace and can be shared or revised. Emitting a deployable metadata file for a guidance question is unsolicited configuration that could be accidentally applied; emitting no file leaves the user without a tangible deliverable.
An artifact request emits only the metadata file(s) asked for — no companion files	Adding a `DEPLOYMENT_GUIDE.md` / `README.md` / `EXPLANATION.md` or an extra `settings` file the user didn't request is noise. Prerequisites belong in a code comment inside the artifact, not a second file.

约束	理由
`encryptionScheme` 必须是 `CaseInsensitiveDeterministicEncryption` 、 `CaseSensitiveDeterministicEncryption` 、 `None` 、 `ProbabilisticEncryption` 中的一个	这些是Metadata API（ `CustomField` ，API 44.0+）接受的唯一值；其他任何字符串都会导致部署失败。
仅当 `enableCacheOnlyKeys` 为 `true` 时，才能设置 `enableReplayDetection`	契约规定“在将enableReplayDetection设为true之前，必须将enableCacheOnlyKeys设为true”——这是单向依赖关系。
仅当字段需要筛选、排序或分组时，才使用确定性方案	概率性加密安全性更高但不支持筛选；确定性加密以部分加密强度为代价换取可查询性。
绝不要声称对概率性加密字段进行筛选/排序/分组会静默返回零行	平台会以 `INVALID_FIELD` 错误拒绝查询（参见注意事项）；告知用户“返回空结果”是不符合事实的。
不要使用 `enableExternalKeyManagement` ——正确字段为 `canExternalKeyManagement`	WSDL元素是 `canExternalKeyManagement` ；某些文档中的示例使用了不存在的元素名称。
事务型数据库、EKM和Data 360密钥字段需要API 63.0+	`canEncryptTransactionalDatabase` 、 `canExternalKeyManagement` 、 `canManageDataCloudKeys` 是在63.0版本引入的。
指导建议类问题仅生成一个Markdown答案文件——绝不生成可部署的 `.settings-meta.xml` / `.field-meta.xml` ，也绝不生成第二个文档	答案文件是用户的参考文档——会保存在工作区中，可共享或修订。为指导建议类问题生成可部署元数据文件属于未经请求的配置，可能会被意外应用；不生成文件则会让用户没有有形的交付物。
工件请求仅生成用户请求的元数据文件——无辅助文件	添加用户未请求的 `DEPLOYMENT_GUIDE.md` / `README.md` / `EXPLANATION.md` 或额外设置文件属于冗余内容。前提条件应放在工件的代码注释中，而非第二个文件。

Gotchas

注意事项

Issue	Resolution
Filtering/sorting/grouping on a probabilistically-encrypted field	The query is rejected with `INVALID_FIELD` : "field '<Name>' can not be sorted / filtered / grouped in a query call." Switch the field to a deterministic scheme if queryability is required.
Assuming Cache-Only Keys auto-enables replay detection	It does not. Set `enableReplayDetection` explicitly, and only after `enableCacheOnlyKeys=true` .
Case sensitivity in deterministic matching	`CaseSensitiveDeterministicEncryption` matches exact case; `CaseInsensitiveDeterministicEncryption` normalizes case. Choosing wrong silently breaks equality filters.
Confusing BYOK with BYOKMS/EKM	BYOK = you upload key material Salesforce stores; BYOKMS/EKM = key material stays in your external KMS. See `references/key-models.md` .
Using `enableExternalKeyManagement` element name	Wrong element. The field is `canExternalKeyManagement` .
Classic Encryption vs Shield	`encryptionScheme` is Shield only. `EncryptedText` custom fields are the legacy Classic feature and out of scope.

问题	解决方案
对概率性加密字段进行筛选/排序/分组	查询会被拒绝并返回 `INVALID_FIELD` 错误：“字段'<Name>'无法在查询调用中进行排序/筛选/分组。”如果需要可查询性，将字段切换为确定性方案。
假设仅缓存密钥会自动启用重放检测	事实并非如此。需显式设置 `enableReplayDetection` ，且仅在 `enableCacheOnlyKeys=true` 之后设置。
确定性匹配中的大小写敏感性	`CaseSensitiveDeterministicEncryption` 匹配精确大小写； `CaseInsensitiveDeterministicEncryption` 会规范化大小写。选择错误会导致相等筛选静默失效。
将BYOK与BYOKMS/EKM混淆	BYOK = 用户上传密钥材料，由Salesforce存储；BYOKMS/EKM = 密钥材料保留在用户的外部KMS中。请参见 `references/key-models.md` 。
使用 `enableExternalKeyManagement` 元素名称	元素名称错误。正确字段为 `canExternalKeyManagement` 。
Classic Encryption与Shield混淆	`encryptionScheme` 仅适用于Shield。 `EncryptedText` 自定义字段是旧版Classic功能，不在本技能范围内。

Output Expectations

输出预期

Deliverables depend on the request — produce exactly these and nothing more:

Guidance questions produce exactly ONE markdown answer file. Any "what happens when…", "how do I…", "which model…", "is X right…" question — including encrypted-field query behavior, Cache-Only/replay-detection relationships, tenant-secret / BYOK / Cache-Only lifecycle, and key-model choices — is answered by writing a single markdown file (e.g.
```
answer.md
```
) that fully captures the diagnosis/explanation. Do not additionally emit a deployable
```
*.settings-meta.xml
```
/
```
*.field-meta.xml
```
or a second doc, and do not answer with no file at all — the answer file is the user's persistent reference document.
Field encryption artifact: only the
```
*.field-meta.xml
```
with
```
encryptionScheme
```
set, written at
```
objects/<ObjectApiName>/fields/<FieldApiName>__c.field-meta.xml
```
. Not a settings file, not a deploy guide. Pick
```
<type>
```
to match the request: Text
for a string field up to 255 chars; LongTextArea
only when the field must exceed 255 chars (256+). "Long text … up to 255 characters" is a
```
Text
```
field, not
```
LongTextArea
```
. Strip the template's instructional comment block from the delivered file — ship clean metadata. Keep the accompanying chat prose tight — one or two sentences naming the scheme chosen and why (e.g. "ProbabilisticEncryption — strongest at-rest protection; the field can't be filtered/sorted/grouped, which matches your no-query requirement"). Do not restate the whole prompt, enumerate every scheme, or add setup/deployment walkthroughs; the deliverable is the file, not an essay.
Org settings artifact: only the settings file the request needs, at
```
settings/<member>.settings-meta.xml
```
named after its Metadata API member —
```
settings/PlatformEncryption.settings-meta.xml
```
(root
```
<PlatformEncryptionSettings>
```
) and/or
```
settings/EncryptionKey.settings-meta.xml
```
(root
```
<EncryptionKeySettings>
```
). Do not name the file after the root element, and do not drop it at the repo root.

Do not add companion files (

DEPLOYMENT_GUIDE.md

README.md

, an extra org-settings file) that the user did not ask for — state prerequisites in a code comment inside the artifact, or inside the single answer file for guidance. File structure follows the templates in

assets/

交付物取决于请求——严格生成以下内容，无额外内容：

指导建议类问题仅生成一个Markdown答案文件。任何“当……时会发生什么”、“我该如何……”、“哪种模型……”、“X是否正确……”的问题——包括加密字段查询行为、仅缓存密钥/重放检测关系、租户密钥/BYOK/仅缓存密钥生命周期、密钥模型选择——都通过编写单个Markdown文件（如
```
answer.md
```
）来回答，文件需完整包含诊断/解释内容。不要额外生成可部署的
*.settings-meta.xml
/
*.field-meta.xml
或第二个文档，也不要仅口头回答而不生成文件——答案文件是用户的持久参考文档。
字段加密工件：仅包含设置了
```
encryptionScheme
```
的
```
*.field-meta.xml
```
文件，路径为
```
objects/<ObjectApiName>/fields/<FieldApiName>__c.field-meta.xml
```
。不要生成设置文件或部署指南。根据请求选择
```
<type>
```
：**
```
Text
```
用于长度不超过255字符的字符串字段；
```
LongTextArea
```
**仅用于长度超过255字符的字段（256+）。“最长255字符的长文本”属于
```
Text
```
字段，而非
```
LongTextArea
```
。移除交付文件中的模板注释块——提供干净的元数据。配套的聊天内容要简洁——用一到两句话说明选择的方案及原因（例如“ProbabilisticEncryption——最强的静态数据保护；该字段无需筛选/排序/分组，符合您的需求”）。不要重述整个请求、枚举所有方案或添加设置/部署步骤；交付物是文件，而非文章。
组织设置工件：仅生成请求所需的设置文件，路径为
```
settings/<member>.settings-meta.xml
```
，以Metadata API成员命名——
```
settings/PlatformEncryption.settings-meta.xml
```
（根元素
```
<PlatformEncryptionSettings>
```
）和/或
```
settings/EncryptionKey.settings-meta.xml
```
（根元素
```
<EncryptionKeySettings>
```
）。不要以根元素命名文件，也不要将文件放在仓库根目录。

不要添加用户未请求的辅助文件（

DEPLOYMENT_GUIDE.md

、

README.md

、额外组织设置文件）——前提条件应放在工件的代码注释中，或指导建议的单个答案文件中。文件结构遵循

assets/

中的模板。

Cross-Skill Integration

跨技能集成

Need	Delegate to
A custom field with no encryption	`platform-custom-field-generate`
The raw Metadata API type/field reference	`platform-metadata-api-context-get`

需求	委托给
无加密的自定义字段	`platform-custom-field-generate`
原始Metadata API类型/字段参考	`platform-metadata-api-context-get`

Reference File Index

参考文件索引

File	When to read
`assets/encrypted-field.field-meta.xml`	Before generating an encrypted custom field
`assets/PlatformEncryption.settings-meta.xml`	Before generating org encryption-policy settings (member `PlatformEncryption` )
`assets/EncryptionKey.settings-meta.xml`	Before generating key-management settings — Cache-Only, EKM, Data 360 (member `EncryptionKey` )
`references/encryption-schemes.md`	When choosing deterministic vs probabilistic, or explaining encrypted-field query behavior
`references/key-models.md`	When configuring or explaining BYOK / BYOKMS / EKM / Cache-Only key models
`references/tenant-secret-lifecycle.md`	When the user asks about key rotation, destruction, or BYOK upload
`examples/cache-only-keys.settings-meta.xml`	To verify a generated Cache-Only key-settings file
`scripts/validate-encryption-metadata.sh`	After generating any settings XML — validates the replay dependency and scheme enum

文件	阅读时机
`assets/encrypted-field.field-meta.xml`	生成加密自定义字段之前
`assets/PlatformEncryption.settings-meta.xml`	生成组织加密策略设置（成员 `PlatformEncryption` ）之前
`assets/EncryptionKey.settings-meta.xml`	生成密钥管理设置——仅缓存密钥、EKM、Data 360（成员 `EncryptionKey` ）之前
`references/encryption-schemes.md`	选择确定性vs概率性加密，或解释加密字段查询行为时
`references/key-models.md`	配置或解释BYOK/BYOKMS/EKM/仅缓存密钥模型时
`references/tenant-secret-lifecycle.md`	用户询问密钥轮换、销毁或BYOK上传时
`examples/cache-only-keys.settings-meta.xml`	验证生成的仅缓存密钥设置文件时
`scripts/validate-encryption-metadata.sh`	生成任何设置XML之后——验证重放依赖关系和方案枚举