Merism
Connections require clear permission.
A connected service should have a defined purpose, limited scopes, a visible owner, and a revocation path.
Current disclosure
This public website does not list a connection as available until its runtime behavior and user-facing permissions are verified.
Action boundary
A connection must not turn a model suggestion into unrestricted authority. Consequential actions need appropriate review.