Agent Authorization Policy

1. Owner authority and provider choice

External agents connect through the supported authorization process. The owner reviews the provider and displayed data/action scopes and decides whether to connect. The authorization must explain important limits and duration. Approval covers the specified access; it does not authorize every future permission or unrelated legal obligation.

2. Permission boundaries

Agents may access only permitted accounts, data and actions within their scopes and valid owner instructions. Feature-level checks still apply. An agent submitting a profile draft cannot replace required owner approval for publication. Untrusted content is not authorization, and agents may not approve their own permission expansion or impersonate an owner's confirmation.

Higher-risk actions must use the owner or authorized-administrator process specified for that action. The live interface and API documentation must accurately explain scopes and approval requirements.

3. Grants tokens and revocation

Approved grants continue until revoked or otherwise ended under the Service's security rules. Access tokens are short-lived, with rotation used to continue permitted access where supported. A short token lifetime is not the lifetime of the underlying grant. Exact token and propagation details must remain consistent with the implementation.

Owners can review and revoke connections through owner controls. Revocation prevents further authorized use of that grant. It does not reverse completed actions, recall public posts or erase information already held by a provider. Those actions or copies may require separate handling.

Account recovery invalidates human sessions and preserves existing agent grants. If compromise is suspected, recover the account and separately review and revoke agent connections. Do not assume recovery disconnects agents.

4. Developer and provider responsibilities

Identify integrations accurately, disclose relevant data practices, protect credentials and acquired information, request only necessary permissions, and use documented endpoints and limits. Handle token expiration and revocation and stop using revoked authority. Do not log secret tokens, forward them to unrelated parties or use Ologu authorization to collect unrelated information.

Providers remain responsible for their own lawful processing, transparency, security and deletion duties. OAuth success does not mean Ologu has endorsed or audited them. An incident affecting Ologu credentials or data must be reported through the established security route without undue delay where required by law or a separate agreement. The route must be working before launch; the designated inactive mailbox is not currently usable.

5. Integration enforcement

Ologu may restrict or revoke integration access for policy violations or material security risks. The Terms' notice and review safeguards apply where appropriate. A connection does not create a commercial API agreement, enterprise agreement or processor arrangement beyond what is actually agreed; separate arrangements may be needed for those uses.

6. Account closure boundary

A permitted agent may initiate a deletion request, but only the authenticated human owner can separately confirm the exact account and displayed consequences. The enabled owner-confirmed process schedules deletion after 30 days and permits cancellation before the deadline. An agent cannot confirm, cancel or execute deletion. Availability depends on the deployed feature and readiness checks; interruption does not authorize an agent to bypass them.