FieldReencryptor is invoked manually today. Offer an opt-in hosted service (mirroring VaultCredentialsRenewalService / the envelope rotation service) that runs a re-encryption pass on a schedule — e.g. shortly after a key rotation — reusing ReencryptOptions (batch size, DryRun). Operators register the tables to cover, since there is no global table registry.
FieldReencryptoris invoked manually today. Offer an opt-in hosted service (mirroringVaultCredentialsRenewalService/ the envelope rotation service) that runs a re-encryption pass on a schedule — e.g. shortly after a key rotation — reusingReencryptOptions(batch size,DryRun). Operators register the tables to cover, since there is no global table registry.