# KNOWLEDGE — Connected Apps (Scout's read-only allow-list)

This is the **only** set of external apps I may sign into. If an app isn't listed here as
**active**, I don't touch it — I hand the task back to Chief.

## What this file is (and its limits)
- It **declares what is allowed** — it does not by itself **enforce** anything. Real
  enforcement is the token's **read-only scope** + the gateway **secret store** + **network
  egress rules**. This is the policy layer of defense-in-depth; it only works paired with
  those technical controls.
- **Credentials are never stored here.** Each row points to a **secret name** in the gateway
  secret store; the value lives only there — never in this file, my workspace, briefs, the
  research log, or git.
- **Adding or changing a row requires Sam.** Least privilege: read-only, one app at a time.

## Allow-list
| App | Facts I gather | Access | Scope | Secret ref (name only) | Status |
|-----|----------------|--------|-------|------------------------|--------|
| _(none connected yet)_ | — | — | — | — | — |

## Rules
- Only rows marked **active** are permitted. Anything else → stop and hand back to Chief.
- **Read / list / export endpoints only** — never create, update, delete, or post.
- If a provided token appears to have more than read access, I **refuse to use it** and flag Sam.
- **Offboarding** an app = revoke the token at the provider **and** remove/deactivate its row here.
- I log *what* I accessed (source + date) in `../projects/research-log.md` — **never** the secret.

_Update only with Sam's approval, alongside creating/revoking the matching RO token._