connections — the v1 surface, designed
Plug in the places your information lives.
Google Workspace, Microsoft 365, Slack, Jira, Azure, a NAS, a database — connected in a consent screen, not a code review. Then parsed into typed data your automations can report on and answer questions about, under the same proxy, grants, and audit log as everything else.
Today the engine ships three connector kinds — Postgres, object storage, and HTTP. What follows is the v1 connector surface as specified, arriving in phases; this page will say so as each one lands, and not before.
the surface
Setup is self-serve. Reachability is reviewed.
Four screens: the wall of connections, the catalog, the verification probe, and the grants. Try it — this is the designed behavior running against local state, with nothing real behind it. Connect a service and it joins the wall; revoke one and everything referencing it goes visibly stale.
connections — the wall
4 connections · secrets in executor custody
the contract
Four questions, or it does not ship.
A new service is never a new engine feature. Every connector — present or future — is fully described by four answers, registered as data. A connector that cannot answer all four is not ready to exist.
transport + auth
How the proxy reaches the service, and what secret it custodies. Custody is always executor-side; a container only ever holds the socket.
verbs
The closed set of operations a resource may expose - query, get, put, search, post. Declared in the definition, enforced per grant.
scope grammar
How a grant narrows the service in the service's own terms. “Full access” is not a grammar.
audit shape
What one call writes to the run log: verb, target, the scope decision - including denials - and what moved, by handle.
the split
A connection is not a resource.
A connectionis a credential and an endpoint — created in the surface above, held by the executor, never present in YAML, a diff, or a container. A resource is what jobs actually touch: a definition that references the connection by name and declares the verbs it exposes, entering through plan and apply like any other change.
That split is what makes self-serve setup safe. Anyone permitted can connect their workspace; no job can reach it until a reviewed definition says so. Rotating or revoking a credential touches no definitions at all.
the two halves
connection m365-prod · token pair · executor custody
created in the surface · no review · revocable in place
kind: resource name: board-files@1 connector: ms.graph connection: m365-prod verbs: [get, list]
ptn plan && ptn apply — reviewed, like any other change
the catalog
Scope, in each service’s own words.
A grant never says “full access.” It narrows the service in the grammar the service itself understands — the same move as the row filter, the key prefix, and the URL allowlist that ship today. Grammars rhyme across connectors wherever the service allows it: the Jira grant is a JQL fragment ANDed onto every query, which is the Postgres row filter wearing different clothes.
- Google Workspacegoogle.* — folder-ID prefix · spreadsheet ID + range · label or query filter
- Microsoft 365ms.graph — site ID · drive ID · path prefix · workbook + range
- Slackslack — channel allowlist
- Jirajira — project keys + a JQL fragment ANDed onto every query
- Postgrespostgres — SQL row filter
- Azureazure.blob / azure.sql — container + key prefix · row filter · resource-group allowlist
- NAS (SMB)smb — share + path prefix
- MCP servermcp — tool allowlist + argument constraints
parsing
Files are not data yet.
An agent never reads a binary. A spreadsheet from OneDrive, a PDF from the NAS, a mail thread — each lands in the blob store as a file, and a deterministic parser turns it into typed tables and records before any judgement is applied. Parsing is not a matter of opinion, so no model is involved.
Every parsed value carries its provenance — which file, which version, fetched when — so a report can cite its inputs and an answer can say where it came from. This is what turns “connected” into “can make reports and answer questions.”
Have a system we should reach first?
The catalog ships in phases, and design partners set the order. Tell us what your work lives in.