Security boundaries for connected advertising data

Each connector declares the capabilities and permissions it uses. Read-only connectors do not receive an application write path merely because another provider supports writes.

OAuth callbacks and incoming provider webhooks are validated before data is accepted. API keys are checked against the provider before a connection becomes active.

Stored provider credentials are encrypted and resolved only for the server-side connector that needs them. They are not included in agent prompts, activity copy or browser responses.

Logs and connection errors are designed to describe the failure without returning tokens or authorization codes.

Campaign drafts and proposed changes identify their target and values before approval. The preparation step does not grant an agent standing authority to mutate the ad account.

Disconnecting a provider removes its stored credential and stops future provider calls. Data deletion requests are handled through the published deletion process and privacy policy.