How does Catalyst secure workflow state during persistence and replay?

Workflow state is encrypted at rest in the durable store using customer-managed or platform-managed keys. During replay, state is decrypted in memory only for the duration of execution. Catalyst enforces workload identity-based access control, so only authorized agent runners can read or write state. Audit logs track all state accesses. For air-gapped deployments, encryption keys can be stored locally, and no state leaves the environment.