- Logic for which Metadata key should be used for a Resource: Zeroknowledge? Shared? Key Expired? Rotated? - Decrypt Function - Encrypt Function - Verify against Resource Type Schema (like Secrets do) - Unit tests