Partners and API / Marketplace
An install is a grant of access. It is treated like one.
Partner applications installed against your tenant, each carrying an explicit scope, revocable at any time, with its activity recorded.
The convenient version of a marketplace hides what an app can reach. That convenience is exactly what makes third-party access the weakest link in most platforms.
Ask what is availableWhat can an installed application see?
Only what its scope grants, and the scope is shown to you before you install. An application runs under the same entitlement-then-role model as a person, cannot exceed it, and can be revoked immediately — with its activity in the audit log while it was active.
Scope shown, access revocable
How an installation is governed
- 01
Scope is declared before install
What the application requests is presented plainly. An install screen that says “connect” without saying to what is not consent.
- 02
It runs inside your walls
Same entitlement and role checks, same tenant scoping, same forced row-level security. A partner app is a caller, not an exception.
- 03
Activity is audited
What the application did, when, under which identity — available while it is installed and afterwards.
- 04
Revocation is immediate
Uninstalling denylists its credentials. There is no grace period in which a removed application still has reach.
Before you install anything
Questions to ask of any marketplace app
Ask these here and on every platform with a marketplace. Third-party access is the most common route to a breach that was technically nobody’s fault.
| Question | Answer here |
|---|---|
| What scope does it request? | Declared and shown before installation |
| Can it exceed my own access? | No — entitlement then role, same as any caller |
| Is its activity visible? | Yes, in the audit log |
| How fast can I cut it off? | Immediately — credentials denylisted on uninstall |
| Does data leave the platform? | Only within the declared scope, and that is a decision you make knowingly |
The catalog is small, and we will say so
Marketplace pages usually imply an ecosystem. Ours is early, and pretending otherwise would be discovered in the first conversation.
Few applications today
We are early-stage. Ask what actually exists rather than assuming a category is covered, and we will give you the real list.
Partner quality is the partner’s
We govern access, not the quality of somebody else’s software. An installed app’s bugs are theirs.
Install is a security decision
The mechanics are safe and revocable. Whether to grant a third party access to claim data remains a judgment worth making deliberately.