Inventory before connection
Write down the exact workspace, account, repository, folder, or channel the agent needs. If a narrower scope works, use it.
Use the least-powerful credential
- Prefer delegated sign-in or a scoped connector over pasted secrets.
- Do not paste passwords, refresh tokens, private keys, or recovery codes into a prompt.
- Separate read access from write access when the platform allows it.
- Revoke unused connections and record who owns renewal.
Prove the connection
A connector appearing in a menu is not proof that the current session can use it. Run one harmless read against a known record, verify the account identity, and only then allow the prompt to depend on it.
Evidence note: tool discovery, authentication, authorization, and a successful operation are four different states.