Connect Governed Enterprise Data

Enterprise problem: A generated application needs governed enterprise facts, but embedding a Salesforce token, Snowflake key, broad query role, or private-network route in source would let one preview expose credentials or reach data beyond the approved customer purpose.

Whole-course context: The incoming artifacts are Day 03’s revision-bound preview, per-app managed stores, migration records, and layered validation evidence; this day adds enterprise connectors before human application identity is configured.

Today’s slice: An enterprise administrator provisions Salesforce and Snowflake connectors, private paths, minimized operations, and a preview-runtime workload grant through independent credential, secret, query, and egress brokers.

End-of-day evidence: Authorized revenue reads carry lineage, while synthetic tests prove denial of secret retrieval, arbitrary query, cross-app connector, wrong source-account scope, and unapproved network paths.

Still unsolved: Human sign-in, delegated or on-behalf-of reads, generated-app roles, sharing, production promotion, and fleet operations remain explicitly deferred.

The customer outcome is a reliable, reviewable implementation of 04 evaluation falsification and security. This day introduces the mechanism before policy detail and evidence review; it does not repeat the same customer stories in prose, tables, and diagrams.

Control-plane service owns desired state; runtime workers own execution; the policy/release boundary owns privileged effects. Compute: isolated service or sandbox tasks. Storage: PostgreSQL owns durable state, Redis is a bounded cache, object storage keeps artifacts/evidence, and queues are delivery buffers rather than authority.

Implement the topic as an owned state transition with a named controller, durable record, bounded worker action, and observable terminal evidence. Verify a denied or failed path before calling the mechanism complete.

A working chart and a green happy-path test can coexist with prompt injection, cross-tenant reads, leaked credentials, compromised dependencies, or self-approved evidence. The smallest defensible claim is narrower: an administrator provisions one bounded machine/workload grant, the Workboard runtime uses typed brokers over an approved route, source systems retain authority, and independent evidence records allowed, denied, failed, and recovered outcomes. Optional delegated user authority comes only after that machine path is proved and is never inferred from provider or application identity.

Security gates attached only to publication miss unsafe generation, stale evidence, rollback gaps, and incomplete deletion, so controls follow the application from the first prompt through final evidence expiry. A gate may narrow or block a claim; it never converts provider documentation, a model grade, or an unobserved expectation into proof.

The release claim is bounded: the named application revision passed the named corpus, policies, environments, and time window. It is not a certification, universal safety guarantee, or statement that Daytona, Cloudflare, Salesforce, or Snowflake makes the generated application compliant.

The full lifecycle shows that Day 04 proves a governed connector slice, not application identity, publication, continuous operations, retirement, or certification.

Describe only the connector controls and evidence observed for the named revision, environment, sources, policies, and time window; leave every later lifecycle claim open.

Starting with OAuth variants, SDKs, or provider features hides the governing authority chain. Begin with three boxes: an enterprise administrator defines purpose and least privilege, a machine/workload executes only a typed operation, and the source returns minimized data plus lineage while remaining authoritative.

For the revenue Workboard, the administrator first provisions salesforce.pipelineByRegion and snowflake.bookedRevenueByMonth for one preview workload. This is service-to-service authority: no human access token is placed in the preview, no user is impersonated, and no application session is treated as source consent. Optional delegated user authority may later be added only as a separate source-native grant with its own issuer, audience, consent, operation scope, expiry, refresh, revocation, and evidence.

One complete authority-and-data loop establishes administrator intent, machine execution, source ownership, minimized output, and lineage before implementation detail.

Prove the admin-provisioned workload path first; add delegated user authority only when the customer job truly requires per-user source decisions and the separate grant can be denied and revoked independently.

A provider administrator and an application end user can be the same human but still exercise different tokens, resources, sessions, and revocation paths, so provider authentication, runtime workload authority, generated-app authentication, and source authorization must be implemented and tested independently. A provider token cannot authorize a Workboard tenant row, an app session cannot create sandboxes or change connectors, and neither can substitute for a source-native workload or optional delegated grant.

If the generating agent can edit the test oracle, evaluate itself, approve exceptions, and sign release evidence, a malicious or merely wrong change can manufacture a pass. SRP separates generation, enforcement, observation, mapping, and approval; DRY keeps one versioned control catalog and one canonical evidence schema shared across application archetypes and runtime adapters.

A checklist stating that a control exists is not falsifiable, so the complete system runs the complete Workboard connection and terminates each allowed, denied, failed, and recovered path in independently observed evidence. Each material threat needs a preventative or detective control, a protected test, immutable evidence, an accountable owner, and a retention rule. The matrix is a customer control record, not a claim of certification; applicability and retention periods come from the customer’s legal, regulatory, contractual, and records policies.

A connection string is too small a model for enterprise access, because it hides who approved the purpose, which source account and fields are reachable, what network path is used, and how access is revoked. A connector is a HelixWorks control-plane resource that combines source type, source-account scope, approved operations, credential handle, network route, data-minimization policy, lineage policy, owners, environment eligibility, expiry, and revocation state.

The source systems remain authoritative. Salesforce owns its organization records and native authorization; Snowflake owns its account, role, warehouse, database, schema, tables, and source audit. HelixWorks owns the connector definition and provider audit. The preview runtime executes one artifact with a narrowly scoped workload identity. The generated revenue app owns only its app configuration, derived metrics, cache, and app-managed records. A copied row or chart does not transfer source authority.

Creating a connector does not make it available everywhere. A separate binding maps a stable connector_version_id to one app, environment, runtime workload, and operation set. Project membership, preview-link possession, generated-app membership, connector administration, runtime workload authority, Salesforce organization scope, and Snowflake account role are independently granted and revoked.

Today’s actor is an enterprise administrator operating the control plane. Runtime reads use a service credential or workload identity scoped to the preview and connector. There is no established end-user identity yet. Human delegated access and OAuth on-behalf-of (OBO), where an application calls a source using a human user’s delegated authority, belong to the companion authorization course and must not be simulated here as completed capability.

One broker that both stores a secret and accepts arbitrary destinations or query text becomes a high-value confused deputy, so a compromised preview could turn one grant into broad source access. HelixWorks separates duties and evaluates every request against the same app, environment, workload, connector, source-account, operation, and policy version.

A technically valid service credential can still be dangerously broad, and a private route can accidentally expose an entire network, so source-native roles and exact network destinations remain part of the grant. Provisioning must be reviewable before a preview runtime can use it.

For Salesforce, register a dedicated external or connected app and a dedicated integration execution user for the approved organization. Salesforce client-credentials access runs as that configured user, so grant it only the API permissions and object or field access required for pipeline totals; do not reuse an administrator’s session. Prefer a short-lived service flow supported by the organization’s policy, and restrict the client app, execution user, scopes, network controls, and session lifetime. The query broker uses reviewed REST API resource templates and rejects object names or fields outside the connector version.

For Snowflake, create a dedicated least-privilege role, service user, warehouse budget, database and schema grants, and approved views. Keep key-pair material or an approved short-lived credential behind the credential broker. Grant USAGE only on the required warehouse and namespaces plus SELECT on reviewed views; do not grant account administration, table creation, unrestricted information schema, or future objects by default. Apply row-access, masking, and network policy where the source owner requires them.

Private connectivity uses customer-approved endpoints, routes, Domain Name System (DNS), and firewall policy for the exact service. Salesforce Private Connect and Snowflake inbound private connectivity are edition-, cloud-, region-, and account-configuration-dependent; the lab uses test accounts that meet those prerequisites and must not label an ordinary public TLS route “private.” The egress broker resolves and checks the destination at connection time, pins permitted ports and transport security, blocks loopback, link-local, metadata, and unrelated private ranges, limits redirects and response size, and logs both network and connector decisions. A private endpoint identifier is not a data grant.

Provisioning validates ownership and reachability separately:

1. The administrator proves authority to create a connector in the HelixWorks project scope.
2. A source administrator creates or approves the narrowly scoped Salesforce integration principal and Snowflake service role.
3. The private-connectivity owner approves endpoint, DNS, routing, firewall, and egress policy.
4. HelixWorks validates source account identifiers, operation templates, field allowlists, budgets, expiry, and audit destinations.
5. A synthetic broker probe authenticates and executes a no-sensitive-data health operation.
6. Only then can a specific preview runtime workload receive a connector binding.

A correct authorized query can still extract unnecessary personal or commercial data, and a chart without provenance cannot be reconciled or investigated. Data minimization restricts collection to fields, rows, precision, time window, and retention needed for the approved purpose; lineage records where a result came from and which transformations produced it.

The revenue dashboard needs regional pipeline and booked-revenue aggregates, not every contact, note, email address, opportunity description, or raw transaction. Prefer approved source views or API fields that already enforce this contract. Apply row limit, time window, grouping, suppression threshold, and maximum precision before the result crosses the broker boundary when the source supports it.

Each result envelope records connector version, source type and account, source object or view identifiers, canonical operation-template digest, parameter digest with sensitive values protected, source-observation time, retrieval time, policy version, transformation digest, app revision, cache key, freshness deadline, row count, and suppression decisions. Source-native audit IDs are linked when available.

The preview cache is generated-app data. It has its own encryption, tenant or audience scope, retention, reset, export, and deletion policy. Cache reset does not delete Salesforce or Snowflake records; source deletion does not automatically prove every authorized export or cache copy is gone. Revocation stops future broker reads but cannot recall data already exported or downloaded, so retention and downstream-use controls matter.

Freshness is part of correctness. The dashboard labels the source observation and last successful refresh, distinguishes partial source failure from zero revenue, and refuses to merge snapshots from incompatible periods without an explicit rule. A stale result may be displayed under a declared tolerance; it must never masquerade as current.

If provisioning, private routing, runtime binding, queries, and denial paths are tested separately, a scope mismatch can survive between them and expose real data. The primary lab follows one enterprise administrator connecting one revenue-dashboard preview through both sources with synthetic or approved test datasets.

1. Open revenue project revenue-insight and preview preview-rev-12; verify artifact, app environment, runtime workload, and managed-cache namespace are explicit.
2. Create stable Salesforce connector sf-pipeline and immutable version sf-pipeline-v1 for test organization sf-org-test-01, operation pipelineByRegion, approved objects and fields, 90-day window, 500-row cap, opaque service-credential handle, and private route.
3. Create stable Snowflake connector snow-bookings and immutable version snow-bookings-v1 for test account snow-acct-test-02, dedicated role and warehouse, view ANALYTICS.APPROVED_BOOKINGS, operation bookedRevenueByMonth, opaque key handle, cost timeout, and private route.
4. Run configuration tests that validate source-native scopes without exposing secret material. Record source account, role or principal, endpoint, operation-template, field, row, time, and expiry policies.
5. Bind both connector versions only to runtime workload wl-preview-rev-12 for the revenue app’s preview environment. Verify a Workboard runtime and another preview workload receive no binding.
6. Execute the two typed operations. Join only the approved region and month aggregates, store the minimized result in the app preview cache, and display freshness plus lineage in the dashboard.
7. Revoke version sf-pipeline-v1 and its workload grant without deleting stable connector sf-pipeline; require future Salesforce calls to fail while snow-bookings-v1 remains independently usable. Label any retained cache stale according to policy, then provision successor version sf-pipeline-v2 under the same stable connector and prove workload reads resume under a new grant and evidence record.
8. Rotate the Snowflake key handle and verify the broker uses the new secret version without source or generated-code changes.

The lab uses workload and service authority only. No employee signs in to the generated app, and no request claims to carry a person’s Salesforce or Snowflake delegation. That human authorization and tenant/role mapping is intentionally deferred to the companion authorization course.

A successful dashboard proves only the permitted path, while the most consequential failures live in paths the customer never intended. Abuse tests therefore use synthetic test principals, workload identities, connector bindings, and source-account scopes rather than assuming end-user identity taught later.

One clean administrator lab can be a lucky run, so a platform release based on it may fail when credentials rotate, routes flap, source schemas drift, or policy changes. A small versioned corpus repeats connector provisioning and operation in clean test projects and deliberately mutates important claims.

The evaluated unit includes connector schema, policy engine, credential and query brokers, egress policy, private-connectivity configuration, source test account, runtime binding, minimization, lineage, retries, and evidence exporter. Pin versions and start each run with a fresh connector, workload, cache, and short-lived test credential. Report distributions with sample counts, failure classes, latency, cost, and denial rate rather than a best result.

Revenue analytics is read-heavy and can hide connector assumptions that fail for workflow or public-ingress applications, so reference probes keep the shared platform contract honest. They are bounded policy tests, not additional live enterprise integrations.

A connector result without exact workload, source-account, policy, and network context can be misattributed to a different grant, so an audit summary alone is insufficient. The evidence ledger links control-plane approval, broker traces, source-native audit, minimized result, and app cache without storing secret values.

Connector designs are easy to generalize from informal examples, so implementation and review should use official protocol, security, and source-system documentation. These primary sources describe the capabilities referenced here; the customer’s exact Salesforce and Snowflake editions, policies, and configurations still determine availability.

• Salesforce REST API Developer Guide — official API resources, request patterns, limits, and error behaviour for reviewed operation templates.
• Salesforce OAuth 2.0 Client Credentials Flow — official service-to-service flow guidance; use only under the source organization’s explicit connected-app and run-as-user policy.
• Salesforce Private Connect — official private-connectivity concepts and configuration boundaries.
• Snowflake key-pair authentication — official public-key authentication and rotation guidance for service access.
• Snowflake private connectivity — official inbound private-connectivity requirements and platform-specific paths.
• Snowflake ACCESS_HISTORY — official source-native lineage and access-history fields, subject to edition and retention constraints.
• NIST SP 800-207, Zero Trust Architecture — resource-level policy decisions that do not treat network location as authorization.
• RFC 9700, Best Current Practice for OAuth 2.0 Security — IETF security recommendations for OAuth deployments; human delegation remains companion authorization-course scope.

Enterprise connectivity has many independent controls, and a compact summary prevents a private route or valid credential from being mistaken for data authorization. Keep these rules visible before identity and sharing are added.

• A connector is a versioned, revocable control-plane grant, not a credential string.
• Credential, secret, query/API, private-connectivity, and egress brokers separate duties and never expose source secrets to generated code.
• The preview workload, connector binding, source account and role, operation template, and network route must all authorize the same request.
• Source systems retain authority; app caches and derived metrics retain lineage, freshness, minimization, and separate lifecycle rules.
• Human delegated and on-behalf-of reads are not taught or claimed in this course; the companion authorization course owns them.
• Repeated clean runs, abuse denials, and caught mutations bound the connector claim without proving universal reliability.

A revenue chart can be correct while the secret, query, source-account, or route boundary is wrong, so the administrator must review both success and denied side effects. Every checked item should point to an immutable broker or source record.

• [ ] Each connector names app, environment, runtime workload, source account, operations, fields, budgets, route, owners, expiry, and revocation state.
• [ ] Salesforce and Snowflake principals or roles are dedicated, least-privilege, and source-admin approved.
• [ ] Secret values never reach prompts, source, runtime, browser, app stores, or logs.
• [ ] Query/API operations are typed, parameterized, minimized, schema-checked, and budgeted.
• [ ] Private reachability is exact and independently authorized; metadata, loopback, public, and unrelated private paths are denied.
• [ ] Lineage links source request, policy, transformation, cache, freshness, app revision, and displayed result.
• [ ] Synthetic wrong-account, cross-app, raw-query, secret, over-broad-result, replay, and network tests fail before sensitive effects.
• [ ] Connector revocation and credential rotation are independent and observable.
• [ ] The evaluation reports all runs, variance, caught mutations, failed paths, and residual gaps.
• [ ] No human sign-in, app-role, delegated-source, sharing, or production claim appears in today’s evidence.

Implement Northstar's supplier connector through the exact-decision boundary in application.ts. Generated code sends a typed operation and an opaque credential reference; it never receives the credential value.

return this.executions.executeOnce(command.tenantId, command.commandId, async () => {
  const decision = await this.policy.authorize({
    capabilityId: command.capabilityId,
    tenantId: command.tenantId,
    runId: command.runId,
    connectorId: command.connectorId,
    capability: command.operation.type,
    resource: resourceFor(command.operation),
    argumentDigest: argumentDigest(command.operation),
    correlationId,
  });
  if (!decision.allowed) {
    throw new ConnectorCommandRejected(decision.decisionId);
  }
  const abort = new AbortController();
  return this.gateway.execute({
    tenantId: command.tenantId,
    credentialReference: command.credentialReference,
    operation: command.operation,
    signal: abort.signal,
  });
});

The command declares one supplier operation. The connector application service interprets it, asks the policy broker for an exact claim decision, and calls the gateway only after allow. Software state changes in the idempotency repository and external supplier system; hardware effects are Node CPU/RAM plus outbound network and the supplier API's capacity. Evidence is the decision ID, operation result, and one recorded side effect for duplicate command IDs.

SRP separates policy decisions, connector orchestration, and vendor transport. DRY centralizes operation hashing and typed contracts. IoC/DI injects the policy, gateway, repository, and timeout. MVC keeps HTTP concerns in the controller. PubSub carries revocation and evidence events; IaC constrains ECS task identity, egress, secrets, queues, and databases per environment.

pnpm vitest run services/connector-broker/src/connector-broker.test.ts
pnpm vitest run services/policy-broker/src/policy-broker.test.ts
pnpm smoke:product

Replay the command concurrently, alter one supplier field after capability issue, switch tenants, revoke the capability, and force a timeout. The implementation passes only when duplicates produce one supplier effect, changed arguments and cross-tenant claims fail closed, revocation takes effect, and errors reveal neither credentials nor resource existence. A private network route alone would not satisfy this evidence.