{"slug":"canonical/adr/ADR-2026-09-04-06-external-systems-remain-authoritative","title":"ADR-2026-09-04-06 — External systems remain authoritative; IntegrateWise connectors are projections","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-04-06-external-systems-remain-authoritative.md","bytes":2457,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** ACCEPTED — 2026-09-04 (founder direction: \"we connect the already-connected\"; Auth-Ecosystem entry model; host-aware continuity spec §10)\n\n## Context\n\nAn integration product's default failure mode is becoming another stale integration: copying\ncredentials, duplicating connections, and snapshotting data that silently diverges from reality.\nThe business's tools are already connected — to hosts, to each other, to SaaS ecosystems.\n\n## Decision\n\n- **Source systems remain authoritative for their own operational transactions.** The Spine is\n  the governed cross-system business context — it connects their meaning; it does not replace\n  them.\n- IntegrateWise connectors are **projections of already-owned connections** (host-owned or\n  Integration-Manager-owned): per-workload projections (workbench read, loader sync, Twin search,\n  approved write) carrying scopes, approval requirements, retention, classification, rate limits\n  and revocation state — never copied credentials, never wider permissions than the host allows.\n- **Host-first access:** confirmed host-native capabilities are preferred for reads and\n  policy-approved writes; IntegrateWise connectors are the managed completion for gaps;\n  connection duplication is avoided unless policy explicitly requires it (ConnectionBinding maps\n  host connection ↔ canonical principal ↔ optional IW integration).\n- The Connector Marketplace first discovers eligible tenant connections and offers **connection\n  reuse**; shared catalog metadata never means shared credentials or shared customer data.\n- Staleness is governed, never silent: sync state, freshness validation at hydration, visible\n  freshness degradation on revocation, and reconciliation of every material outcome.\n\n## Alternatives considered\n\n- Build first-class connectors for everything — rejected: credential sprawl, N×M integration\n  growth, and a second connection estate to maintain.\n- Treat the Spine as the system of record for operational transactions — rejected: creates the\n  stale-copy failure mode and breaks source continuity.\n\n## Consequences\n\nConnector work is judged by projection hygiene (scopes, revocation, freshness), not by coverage\nalone. Revocation must visibly degrade freshness and disable route-dependent capabilities without\ndestroying organizational history (register G-21).\n"}