Integration strategy

Integration uses the least privileged pattern that can prove completion. The default sequence is: standard API/webhook → customer-side agent → ITSM/manual task → controlled file exchange. Direct database writes are never the default.

Connector contract

Every connector declares:

connector_id, tenant_id, type, version
capabilities[]            # discover_metadata, find_subject, correct, suppress, delete, export
data_categories[]
source/destination system
credential_ref            # external secret reference
network policy and countries
read/write scopes
rate/load budget
idempotency and cursor method
evidence method
health/freshness
owner, approver, expiry

Capabilities are separately approved. A metadata scanner cannot automatically gain subject export or deletion permission.

Local agent

The agent runs in the customer trust boundary, polls signed instructions over mTLS, resolves a pseudonymous Principal through a local mapping, performs an allow-listed adapter operation and returns a minimal status/count/hash. It does not accept arbitrary SQL or shell from the control plane. Connector packages are signed, sandboxed where possible and granted network/file/database capabilities through policy.

sequenceDiagram
  participant CP as Control plane
  participant AG as Customer agent
  participant SYS as Source system
  CP->>AG: Poll response: signed scoped instruction
  AG->>AG: Verify signature, policy, expiry, replay
  AG->>SYS: Idempotent approved operation
  SYS-->>AG: Result
  AG->>AG: Redact and create evidence digest
  AG-->>CP: Signed minimal outcome
  CP->>CP: Reconcile task and append audit

Integration modes

Mode	Best for	PII exposure	Failure behavior
API	modern systems with stable contract	minimal request/response	retry/idempotency/reconcile
webhook/event	consent/incident near-real time	purpose/subject refs	signature/replay/dead letter
local agent	databases, on-prem, sovereign	raw PII stays local	spool/health/manual fallback
ITSM task	legacy or human-controlled systems	case-minimised description	acknowledgement/evidence
controlled file	batch legacy migration/fulfilment	encrypted bounded extract	manifest/quarantine/expiry

Credential security

Store only a reference to secrets in cloud KMS/secrets manager/customer vault. Use short-lived OAuth or workload identity, mTLS, database read-only users and separate write credentials. Rotation overlaps safely and is tested. Support cannot reveal the secret; audit records credential version, not value.

Adapter truthfulness

For Board, regulator, core banking, hospital, policy-admin and other non-public/proprietary interfaces, publish a capability adapter contract and mark product/API details unverified until the customer or authority provides current documentation. Never fabricate field names.

Connector release gate

Threat model, least-privilege scopes, injection tests, tenant isolation, secret/log review, idempotency, load budget, rollback, evidence, version compatibility and signed package. Customer approves production activation and can revoke immediately.