Integrations and scopes

An integration is a connected account: Gmail, Google Calendar, Slack, Notion, HubSpot and the rest of the catalog. An admin connects it once for the workspace. Agents never hold the account; they hold a grant to part of it.

Connecting

1. Open Integrations and press Connect on a provider.
2. The provider's own sign-in opens in a popup and lists the scopes Delagents is asking for. Least-privilege bundles are requested, such as draft, label and send for Gmail.
3. Approve there. The popup closes and the integration appears as connected, with the account it is tied to.
4. Grant it to an agent: pick the agent and the subset of scopes it may use.

Scopes are granted per agent

The connection holds the union of scopes the admin approved. Each agent receives a grant with a subset. When an agent calls a tool, the credential check looks at that grant and fails closed outside it: the call returns an error naming the missing scope, and the agent continues without it. Two agents sharing one Gmail connection can have different rights.

Write scopes unlock after a review

A new agent's first run is draft-only. Its write scopes, such as send, post or publish, unlock only after a person has reviewed one complete delegation from it. Even then, the floor still applies: a first message to anyone outside the workspace always waits for a sign-off.

Where tokens live

Tokens are stored encrypted, each under its own key. Plaintext exists only inside the tool call and never reaches logs, the model or a step's payload. Tokens are refreshed shortly before they expire; if a refresh fails, the integration is marked expired, the connecting admin is notified and dependent tool calls return errors instead of running.

Disconnecting

Disconnecting revokes the token with the provider, revokes every grant built on it, pauses running delegations that depend on it with the reason recorded, and writes an activity event. If the provider revokes access from its side, the same path runs.

What an agent cannot do here

Connecting an integration or widening scopes is on the floor. No agent can do either, whatever its policy says. Only an admin or owner can connect, grant or disconnect.

The catalog

At launch: Gmail, Google Calendar, Slack, Notion, HubSpot and web browsing. Following: Google Drive, Zendesk, Intercom, Stripe (read), QuickBooks and Xero (read), Linear and Airtable. Starter includes three integrations; Team and Business include the full catalog.

Preview: the Integrations screen in the current build shows the catalog on demo data. Connecting a real account arrives with the workspace app.