> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corvic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and Security

> Who can see, use, and edit a connector, how connectors are tested, and what a connector can reach.

## Visibility, status, and policies

* **Visibility.** A connector is created either for your organization or privately for you. A private connector is not visible in an organization room, so that room cannot use it. Create the connector for the organization if a shared room needs it.
* **Status and testing.** Each connector shows whether it is working. A test checks the connection in stages (connect, TLS, authenticate, request) and, when a stage fails, says which one and suggests a fix. An OAuth connector shows *needs reconnect* when its sign-in has been refused or has expired.
* **Policies.** Organization admins can set organization-level and room-level policies for how connectors are used; they are enforced by default. A run or an API key can use a connector only when it has been given explicit access to it.

## What a connector can reach

A connector gives agents the access its credential has, no more and no less. Keep these points in mind when you create one:

* **Scope the credential, not the connector.** Corvic doesn't narrow what a credential can do. An API key, a cloud storage credential, or a database user reaches everything its permissions allow, so create one with only the access your agents need: the scopes they use, the buckets they read, the tables they query.
* **Some services echo headers back.** Corvic adds your credential to each request to the connector's host. If that service returns request headers in its response, for example a debugging or echo endpoint, agent code can read the credential there. Connect services whose API doesn't do this, or accept that risk for that credential.
* **A "read-only" Oracle session isn't a security boundary.** Functions with autonomous transactions, `SELECT … FOR UPDATE`, and database links all run with the connector user's grants. Give the database user only the privileges it needs, rather than relying on a read-only session.
* **Members can use connectors they can see.** Any member of your organization can use a connector visible to them in their own agents, without being able to read its secret. Only the connector's owner or an admin can edit it.
* **Revoking takes effect at the next run.** An agent run that already received a connector's credentials keeps them until the run ends. To cut access at once, also revoke or rotate the credential at the provider.

## Related Documentation

> [card] [Policies](https://docs.corvic.ai/rbac/policies.md)
>
> Set organization and room policies for connectors.

> [card] [Dedicated IP](https://docs.corvic.ai/virtual-network/dedicated-ip.md)
>
> Reach services behind an IP allowlist.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.