We use AES-256-GCM (or ChaCha20-Poly1305 if AES unavailable):

ciphertext = AEAD_ENCRYPT(
    key,
    plaintext,
    associated_data   // attribute id, file id, metadata commitment
)

Associated data (AAD) binds encrypted data to its descriptor:

• prevents substitution
• prevents mix-and-match tampering
• ensures vault consistency