Security and Approvals
Least privilege
Request only the scopes, environment, gateway, and lifetime required by the integration. Client credentials do not confer workspace roles and cannot be used to select arbitrary internal targets.
Action classes
- Read operations return bounded workspace-scoped projections.
- Proposal operations, when published in a future contract, may create a review record but do not execute an external write.
- Approval-gated operations require a valid, action-bound approval before execution.
An approval binds the subject, resource, action, environment, version, purpose, and expiry. A visible button or a broad workspace role is not a substitute.
Data handling
Responses, errors, examples, analytics, and support bundles must exclude raw credentials, unrestricted private payloads, internal file paths, table catalogs, administrative targets, and private managed-model identifiers.
Browser origin policy
Server-to-server access is the default. Browser origins are denied unless the published gateway has an explicit exact-origin or same-origin CORS policy. Batoi never reflects an arbitrary Origin, and credentials do not make an unapproved browser origin valid.
Reporting a suspected exposure
Revoke the affected binding, rotate the credential, preserve correlation identifiers and timestamps, and contact support through the published channel. Do not send the credential itself.