{"slug":"connectors/ONE_AUTH_HOST_CONTROLLED_PROJECTIONS","title":"One Auth and Host-Controlled Connector Projections","section":"connectors","sectionLabel":"Connectors","status":"unclassified","type":"document","path":"connectors/ONE_AUTH_HOST_CONTROLLED_PROJECTIONS.mdx","bytes":2226,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** Normative  \n**Date:** 2026-08-11  \n**Parent:** [`INTEGRATEWISE_ARCHITECTURE_v2.2.md`](INTEGRATEWISE_ARCHITECTURE_v2.2.md)\n\n## Principle\n\nOne Auth is the entry to the IntegrateWise ecosystem. The host remains the authority for identity and existing connector ownership wherever the host already owns those connections.\n\nA projected connector is not another provider connection. It is a governed IntegrateWise reference to a host-owned connection.\n\n## Projection contract\n\nA projection may contain:\n\n- `host_id`\n- `host_connector_id`\n- tenant/principal binding\n- provider/account descriptor\n- effective capability grants\n- policy binding\n- schema/version binding\n- lifecycle and health state\n- freshness metadata\n- audit/provenance references\n\nA projection must not contain:\n\n- provider access or refresh tokens copied from the host\n- provider client secrets\n- host session cookies\n- unrestricted host connector grants\n- duplicated provider OAuth authority\n\n## Lifecycle\n\n```text\nHost authenticates user\n→ One Auth validates/binds identity\n→ host connector inventory is discovered\n→ eligible connectors are projected\n→ effective capabilities are resolved\n→ Product Package/Workbench consumes projections\n→ host revocation/health change invalidates dependent projections\n```\n\n## Delegated execution\n\nWhen a Tool Capability needs to act through a host-owned connector, execution should be host-mediated or use a short-lived, audience-bound connector execution grant/lease. The grant must be narrower than the host's underlying authority and must carry tenant, principal, capability, expiry, policy and trace/idempotency context.\n\n## Invariants\n\n1. One host connection should be reusable throughout the IntegrateWise ecosystem.\n2. IntegrateWise does not silently create N×M provider reconnections.\n3. Projection capability is always equal to or narrower than host authority.\n4. Host revocation propagates to all dependent projections.\n5. Provider credentials never enter Workbench/Twin/model prompts.\n6. Product Packages consume projections, not raw credential vault entries.\n7. Discovery and Capability resolution must be host-aware and tenant-aware.\n"}