Connectors

A Connector is a tenant-owned definition of an upstream system and its capability contract. It describes how Axec reaches and authenticates to that system; it is not a User’s connected account. A Connector’s capabilities become operations at an Application gateway Resource.

What a Connector defines

A Connector records:

• Its category and authentication mode.
• Adapter, provider, issuer, endpoint, and upstream Resource metadata.
• OAuth client configuration or typed credential requirements.
• The capabilities it exposes to MCP gateways.
• Configuration, capability, and contract digests.
• Active or disabled lifecycle state.

The supported authentication modes choose the credential source a Grant can pin:

Mode	Credential source	Owner
oauth	OAuth Connection	User
user_credential	Typed personal credential in a Connection	User
vaulted	Connector Vaulted Credential	Workspace
none	No credential	None

Application Connector attachments

An Application Connector attaches a Connector to an Application’s MCP gateway. It defines an administrator-owned ceiling of allowed capability keys and scopes. User consent can narrow this ceiling, but cannot expand it.

Attachments and Connector contracts are live dependencies. Removing an attachment, disabling a Connector, or changing a pinned contract digest can invalidate previously issued authority.

Resources and capabilities

A Resource is the canonical OAuth audience of an Axec MCP gateway. A capability is an operation exposed by a Connector through that gateway. The Resource answers which protected gateway is this token for; the capability answers which operation may this authority invoke there.

flowchart LR
  Contract[Connector capability contract]
  Attachment[Application Connector attachment ceiling]
  Grant[Delegated consent and exact Grant]
  Authority[Live authority checks]
  Policy[Policy decision]
  Capability[Executable capability]

  Contract --> Attachment --> Grant --> Authority --> Policy --> Capability

Every stage can preserve or reduce authority; none can widen the stage before it. For autonomous authority, Axec evaluates the Application’s own active gateway attachments and permits only vaulted or no-auth Connector paths.

MCP clients discover tools projected by current gateway authority and invoke them through the same gateway Resource. Discovery is not a durable grant: Axec evaluates current authority again when a capability is called. Policies and approvals can deny or require approval for a currently authorized capability, while Data Protection can sanitize supported mediated results after execution.

Connector is not Connection

The Connector is shared tenant configuration. A Connection is one User’s authenticated upstream account for that Connector. Replacing one does not silently rewrite the identity of the other.