Each provider SOMA may run jobs on, with a spend cap. A connection is checked with a read-only call when it is saved. Credentials stay with the controller; secret fields are never shown again.