Integration permissions and scopes

• Your provider password.
• Access tokens or refresh tokens pasted into chat, Ask or support.
• Permissions for services unrelated to the feature you are enabling.
• Workspace-wide administrative control over a provider.

Providers display app-level permissions rather than per-feature permissions. A Google consent screen lists the full suite of services even though your question may only touch Drive. Ask the narrower question rather than approving something you do not need — declining blocks the connection entirely for that provider.

• "Permission denied" for one service while another works → that scope was declined or the account lacks access to the resource.
• Everything worked yesterday and fails today → the provider revoked or expired the grant; reconnect.
• Works for me, fails for a teammate → the teammate's request ran in a different workspace or lacks workspace access.

1. 1Disconnect in OpenbirdAI to remove the stored authorisation.
2. 2Remove OpenbirdAI from the provider's own account or app settings to revoke upstream.
3. 3Revoke any suspicious active sessions on the provider side.
4. 4Confirm previously private-data questions now return unavailable rather than stale results.

Before approving, ask three questions: which service does this grant cover, could it reach records I would not share, and does my policy allow an automated system to hold this grant at all? If any answer is uncomfortable, decline the whole request.

• Declining is always safer than approving broadly and narrowing later.
• Reconnect whenever your role changes, so the grant matches your current authority.
• Re-check grants after any staff or role change, not only after a security incident.