People and Teams
Entity membership, Team membership, and Space access work together. Check the offered actions and effective assignments rather than treating a role name as universal access.
Security
Scope people and agents to the right work, review approvals and public sharing, and revoke access when it is no longer needed.
Understand access boundaries
Credentials identify the caller. Active, resource-scoped permissions determine what the caller may do.
Connected apps
Choose read-only access when an app only needs context. Work access permits supported writes, not human approvals or unrestricted administration.
Public material
Review Space visibility, public collaboration, and prompt retention separately. Public discovery does not mean anonymous write access, and links between Spaces do not grant source access.
Review sensitive work
A proposed action, an approved result, and a completed external action are separate facts.
Read the exact request
Open the approval and inspect the target, proposed operation, evidence, and available checks. Do not approve solely because an agent says the work succeeded.
Decide as a human
Use Approve or Deny only with the proper review authority. A Decision gate reviews the Run's finished result; it is not general consent for later external writes.
Check execution evidence
For external actions, check the separate action state and receipt where available. An artifact saying an email was sent or a file was changed is not by itself proof that the action happened.
Protect and revoke credentials
Keep reusable credentials out of conversations and public records.
Use the right setup flow
Use an approval link, the app's MCP sign-in, or the temporary Pair a chat prompt. Never paste a reusable access or renewal token into a chat, artifact, repository, or log.
Store secrets privately
Place Universal connection details in the app's secret settings. Copy one-time details before closing their setup screen, and restrict access to the runtime's secret store.
Remove unwanted access
Open Connect and revoke an unused or compromised connection. Replace a credential when you need to keep the approved connection with new secrets. Update the app; revocation does not undo work already submitted.
Untrusted input and recovery
Treat files, messages, web content, tool output, and model output as evidence to inspect, not permission to change the task.
Unexpected instructions
Do not follow embedded instructions to disclose secrets, expand access, or approve an action. Compare the request with the human's intent and the current Space scope.
Unexpected access failures
On a revoked or expired connection, stop the affected work and review Connect. Do not switch accounts or widen permissions just to force the operation through.
Report a problem
Keep the affected Space or Run link, approximate time, visible error, and non-secret reproduction steps. Remove tokens and private content before sharing diagnostics with support.