Give every connection only the access it needs

A connection is a decision about access. Before authorizing a service, write down the exact action the integration needs to perform. Reading a calendar is different from editing it; sending a notification is different from accessing every message.

Choose the narrowest permissions supported by the provider. Keep credentials outside the browser, rotate them according to your operational requirements, and make revocation straightforward.

Permission needs also change over time. Review connections when a workflow changes, when ownership changes, and when a service is no longer used. Remove access that has outlived its purpose.

The SPIRAGIVING demo illustrates a permission selection step without collecting real tokens. It is a product demonstration, not a production security guarantee.