Unclassified

One Auth and Host-Controlled Connector Projections

Status: Normative
Date: 2026-08-11
Parent: INTEGRATEWISE_ARCHITECTURE_v2.2.md

Principle

One Auth is the entry to the IntegrateWise ecosystem. The host remains the authority for identity and existing connector ownership wherever the host already owns those connections.

A projected connector is not another provider connection. It is a governed IntegrateWise reference to a host-owned connection.

Projection contract

A projection may contain:

  • host_id
  • host_connector_id
  • tenant/principal binding
  • provider/account descriptor
  • effective capability grants
  • policy binding
  • schema/version binding
  • lifecycle and health state
  • freshness metadata
  • audit/provenance references

A projection must not contain:

  • provider access or refresh tokens copied from the host
  • provider client secrets
  • host session cookies
  • unrestricted host connector grants
  • duplicated provider OAuth authority

Lifecycle

Host authenticates user
→ One Auth validates/binds identity
→ host connector inventory is discovered
→ eligible connectors are projected
→ effective capabilities are resolved
→ Product Package/Workbench consumes projections
→ host revocation/health change invalidates dependent projections

Delegated execution

When a Tool Capability needs to act through a host-owned connector, execution should be host-mediated or use a short-lived, audience-bound connector execution grant/lease. The grant must be narrower than the host's underlying authority and must carry tenant, principal, capability, expiry, policy and trace/idempotency context.

Invariants

  1. One host connection should be reusable throughout the IntegrateWise ecosystem.
  2. IntegrateWise does not silently create N×M provider reconnections.
  3. Projection capability is always equal to or narrower than host authority.
  4. Host revocation propagates to all dependent projections.
  5. Provider credentials never enter Workbench/Twin/model prompts.
  6. Product Packages consume projections, not raw credential vault entries.
  7. Discovery and Capability resolution must be host-aware and tenant-aware.