Inventory and enforcement have separate paths.
Connectors synchronize external identity, app, and grant metadata. Tool-call enforcement requires a configured SDK guard or MCP proxy route. Connecting an account alone does not put its API calls behind the gateway.
Built · development scope Provider credentials and permissions are required.
Concept · illustrative
Two paths, not one
Review the provider permissions, route, policy, and failure behavior for each workflow.
Connector scope at a glance
| Connector | Synchronized data | Boundary |
|---|---|---|
| GitHub | Organization app installations and permission-derived grant metadata | Configured organization and required installation permissions |
| Microsoft 365 | Directory applications, service principals, and grants | Configured tenant and Microsoft Graph permissions |
| Slack | Workspace users and installed app metadata | Required user and app-read scopes; not message posting or reading |
| Okta | Apps, assignments, and available grant metadata | Some assignment scopes are synthetic; not complete OAuth permission evidence |
| Google Workspace | Users and OAuth tokens with app and scope metadata | Configured domain and delegated administrative access |
Other implemented capabilities
Grant risk scoring
Flags configured broad or sensitive scopes and produces findings. It does not determine the exact permissions a business task needs or automatically narrow upstream grants.
Pattern-based redaction
The core DLP path masks matching sensitive patterns and fields. Coverage is limited to its detectors. Studio additionally implements entity recognition, tokenization, and a vault; see Studio's privacy boundary and image limits.
Signed webhooks
Deliveries carry HMAC-SHA256 over the timestamp and body, using the endpoint's shared secret. Receivers must verify that HMAC and check timestamp freshness to limit replay. This is separate from Ed25519 decision receipts and the offline proof-bundle verifier.
Policy packs
Versioned rule sets can be installed and edited. Dry-run tests a supplied call context; replay compares recorded calls with explicit sample and reconstruction limits. Review rules and priorities before enforcement.
SDK and MCP enforcement
Python and Node SDKs and the MCP proxy provide routed enforcement paths. Framework wrappers require explicit integration; see the architecture page. Observation APIs collect telemetry without blocking calls.
Check one integration at a time
Review the provider permissions, route, policy, and failure behavior for your workflow. See Discovery, the gateway, and contact.