Skip to main content

​
Visibility, status, and policies

  • Visibility. A connector is created either for your organization or privately for you. A private connector is not visible in an organization room, so that room cannot use it. Create the connector for the organization if a shared room needs it.
  • Status and testing. Each connector shows whether it is working. A test checks the connection in stages (connect, TLS, authenticate, request) and, when a stage fails, says which one and suggests a fix. An OAuth connector shows needs reconnect when its sign-in has been refused or has expired.
  • Policies. Organization admins can set organization-level and room-level policies for how connectors are used; they are enforced by default. A run or an API key can use a connector only when it has been given explicit access to it.

​
What a connector can reach

A connector gives agents the access its credential has, no more and no less. Keep these points in mind when you create one:
  • Scope the credential, not the connector. Corvic doesn’t narrow what a credential can do. An API key, a cloud storage credential, or a database user reaches everything its permissions allow, so create one with only the access your agents need: the scopes they use, the buckets they read, the tables they query.
  • Some services echo headers back. Corvic adds your credential to each request to the connector’s host. If that service returns request headers in its response, for example a debugging or echo endpoint, agent code can read the credential there. Connect services whose API doesn’t do this, or accept that risk for that credential.
  • A “read-only” Oracle session isn’t a security boundary. Functions with autonomous transactions, SELECT … FOR UPDATE, and database links all run with the connector user’s grants. Give the database user only the privileges it needs, rather than relying on a read-only session.
  • Members can use connectors they can see. Any member of your organization can use a connector visible to them in their own agents, without being able to read its secret. Only the connector’s owner or an admin can edit it.
  • Revoking takes effect at the next run. An agent run that already received a connector’s credentials keeps them until the run ends. To cut access at once, also revoke or rotate the credential at the provider.

Policies

Set organization and room policies for connectors.

Dedicated IP

Reach services behind an IP allowlist.