At Level 3, an assistant can request live data instead of waiting for you to paste it. That removes copying, but it also gives the assistant a route to another system. The route must be narrower than the account behind it, inspectable on every call, and proven to refuse access outside the task.
2. The answer is current, but what did the assistant reach?
You prepare a weekly update by copying a meeting date from a calendar, finding a document in a shared drive, and asking an assistant to combine them. The next week you repeat the same copying. A connector looks like the obvious fix: let the assistant read both systems directly.
The authorization screen is the dangerous moment. Your daily account can see personal events, other groups' folders, and perhaps edit or delete records. The assistant needs none of that. If you click through because its final prose looks harmless, you have judged the answer while ignoring the authority behind it.
Your goal is a live connection to a local synthetic sandbox that completes one repeated lookup. You will inspect what the assistant sent and received, then prove that malformed input, an out-of-scope record, and a write request cannot cross the boundary. The same narrow pattern supports a Lab meeting note or a Company ticket note without connecting a production account.
3. After this you can
- Connect an approved assistant to one live synthetic tool under a fixture identity and narrow resource grant.
- Distinguish a connector from a workflow integration, browser extension, skill, and plugin.
- Authorize and inspect only the identity, resources, operations, arguments, and result required by one task.
- Test an allowed read plus invalid, unauthorized, missing, and write-shaped requests before using a connector for work.
- Decide whether the connection removes repeated copying or merely relocates it.
4. Prerequisites
T02-L02| Your daily driver.T05-L02| Automations with AI in the middle.- An organisation-approved assistant with a connector already provisioned against the Coordination Sandbox, or an equivalent synthetic test tenant owned by your organisation.
- A connection details page or approved test view that displays the publisher, endpoint or connection identity, granted resources, discovered tools, arguments, results, and errors.
- A fixture owner who can confirm the expected synthetic records and revoke the connection. If your client hides calls or cannot exercise denied cases, use its approved test view or stop the exercise.
Do not substitute your everyday account, a production drive, a live calendar, a customer ticket queue, or an endpoint copied from a message. Never paste an API key, OAuth token, password, cookie, private key, or authorization header into a prompt, configuration screenshot, or test record. You are consuming and testing an approved connector in this book, not writing or deploying one. Building a connector belongs in T14-L04 | Build your own connector.
5. The idea in one page
A connector is an authorized route through which an assistant can discover and call defined tools. Each tool should name one operation, validate structured input, check the caller and resource, return a bounded result, and report explicit errors. MCP standardizes discovery and invocation; it does not certify a publisher or replace authorization.
Name the thing before you authorize it
Product labels overlap, so classify by behavior and authority:
| Mechanism | What it does | Where the important boundary sits |
|---|---|---|
| Connector | Gives an assistant a managed route to selected external data or actions. An MCP connection can be a connector. | Tool list, account, resource scope, server authorization, and revocation. |
| Workflow integration | Moves data through a predefined trigger-and-action path, such as new form submission to a review queue. | Trigger scope, mappings, branches, credentials, and each action. |
| Browser extension | Runs installed code in a browser and may read or alter permitted pages. | Publisher, requested browser permissions, page access, and update channel. |
| Plugin or extension package | Adds code, tools, instructions, or several of these to a host runtime. | Package publisher, install permissions, included capabilities, and updates. |
| Skill | Supplies reusable instructions for how to perform a task. | The instructions themselves; a skill should not be confused with enforced authority. |
A connector may use an integration, and a plugin may install a connector. The label is not the decision. Ask: Which operations become callable, under whose identity, against which resources, and what code enforces refusal?
Scope four dimensions
Least privilege is not just read-only. Define four dimensions:
- Identity: use a named training identity, not a shared administrator or broad daily account.
- Operation: allow only the exact reads required. Do not grant create, update, delete, send, export, share, or administrative operations.
- Resource: restrict the read to one synthetic calendar, one folder, or one queue rather than a whole tenant.
- Time: authorize for the exercise and know how to revoke immediately.
Client controls can hide a tool or request confirmation, but the server must enforce access independently. Only read the group folder is guidance, not proof. A direct out-of-scope call must return forbidden even if the model proposes it.
Read the call, not only the response
A visible tool call has four parts:
proposal: the assistant selects a tool and prepares arguments
request: tool name, structured arguments, caller context, request ID
enforcement: schema validation, authentication, authorization, source permission
result: minimal data or an explicit invalid_input/forbidden/not_found error
Inspect the exact tool name and arguments before approval when the client offers confirmation. After execution, inspect fields and errors. A failed lookup must not broaden its search, substitute a folder, return a complete document when metadata is enough, or leak a stack trace. The assistant's polished sentence is a separate, fallible interpretation.
Keep credentials outside prompts, calls, screenshots, and logs. A useful trace records request ID, tool, safe argument categories, time, and outcome, not a token or complete sensitive result. Review publisher, endpoint, permissions, support, and update route before using a third-party connector.
Test one allowed read, malformed input, an out-of-scope ID, a missing in-scope record, and a write-shaped request. Require bounded data, an explicit validation failure, a clear forbidden outcome, a clear not-found outcome, and no write tool respectively. An absent write tool is better than one accompanied by please do not use. Keep a connector only when bounded current retrieval removes a repeated handoff; leave consequential updates to a person.
6. The worked example: consume one narrow connection, in two settings
This example assumes an administrator or course facilitator has already provided the Coordination Sandbox through your approved assistant. It is a live connector backed only by invented records. You do not install an SDK, write a server, choose a transport, or deploy an endpoint here. Those implementation decisions are deliberately reserved for T14-L04.
The fixture offers two separately authorized profiles:
| Profile | Allowed synthetic resources | Expected discovered tools | Tools that must not appear |
|---|---|---|---|
coordination-lab | calendar grp-alder; folder fld-alder-protocols | list_group_events, search_shared_docs | create, update, delete, send, share, broad search |
coordination-company | queue q-support-training; folder fld-support-playbooks | get_team_ticket, search_shared_docs | comment, update, close, delete, export, broad search |
Treat those names as a contract, not proof. Before connecting, open the approved catalog entry from inside your organisation's trusted route. Record the exact publisher, connection name, owner, synthetic environment, requested resources, operations, expiry, and revocation control. Do not follow a sign-in or endpoint link delivered in chat or email. If the consent screen asks for a whole drive, all calendars, all tickets, offline access without an explained need, or any write permission, cancel.
After authorization, refresh the tool list. Compare every discovered tool with the profile row. Tool descriptions and annotations can help explain intent, but the current MCP specification says they are not a security boundary: they come from the server and may be inaccurate. The source grant and server-side authorization must carry the restriction. Disconnect if a write tool or undeclared broad read appears.
The fixture owner supplies this expected-record sheet. It lets you distinguish a real observed call from a plausible assistant answer:
| Resource | In-scope expected record | In-scope missing case | Out-of-scope case |
|---|---|---|---|
| Lab calendar | EVT-104, 9 September 2026 | date range 1-2 October 2026 | grp-directors |
| Lab folder | DOC-208, sandbox://DOC-208 | query violet assay | fld-finance |
| Company queue | TKT-317, status open | TKT-999 | q-executive |
| Company folder | DOC-412, sandbox://DOC-412 | query REFUND-AUDIT | fld-board |
These are expected fixture values, not evidence that your connection worked. Your evidence begins only when your own client or approved test view displays a request and result.
Establish a small test ledger
Create a temporary ledger in your notes. It is working material, not an additional exit artifact.
| Test | Exact input you observed | Required outcome | Observed outcome |
|---|---|---|---|
| allowed read | approved resource and bounded query | expected source ID and minimal fields | pending |
| malformed input | wrong date or ID shape | explicit validation error | pending |
| unauthorized resource | valid-shaped out-of-scope ID | forbidden, with no record data | pending |
| missing record | valid in-scope request with no match | not found, without wider search | pending |
| write-shaped request | domain-appropriate change | no write tool, or explicit denial | pending |
The wording of errors varies by product. invalid_input, forbidden, and not_found are useful categories, not magic strings. Pass a row only when the behavior is unambiguous. A generic failure does not prove authorization, because a network error could look similar. A forbidden result must reveal no title, summary, owner, or other content from the forbidden resource.
Use the assistant's visible call panel for the allowed run. For malformed and denied cases, use the organisation-approved connector test view if the assistant will not deliberately submit them. MCP Inspector is an official developer tool, but installing or operating it is not required for this Level 3 exercise. If your organisation already provides it, use the approved managed instance and its documented connection procedure; do not paste bearer tokens into its fields or launch an unreviewed package command from this book.
Lab framing: prepare a group-meeting note
Ask the connected assistant:
Using only the connected Alder training calendar and protocol folder, give me the
next meeting from 2026-09-04 through 2026-09-18 and the newest document matching
"blue assay". Include source IDs and links. Show calls. Do not change anything.
Inspect calls for grp-alder and fld-alder-protocols. The expected sources are EVT-104 and DOC-208; your screenshot is evidence only if your own live call shows them. In the approved test view, test malformed date tomorrow, group grp-directors, absent query violet assay, and an unregistered update_group_event. Require a clear invalid-input result, forbidden result, not-found result, and unavailable tool respectively.
Company framing: prepare an internal ticket note
Use the Company actor and ask:
Read synthetic ticket TKT-317 from q-support-training. Find the newest document in
fld-support-playbooks matching its procedure tag. Draft an internal note with source
IDs and links. Show calls. Do not comment, update, send, or close anything.
The expected sources are TKT-317 and DOC-412. Test malformed ID ticket-317, queue q-executive, absent TKT-999, and unregistered update_ticket. These are expected fixture outcomes until you run them. Neither profile should be able to alter state: no write tool may be discovered, and the fixture owner must confirm that its underlying identity has no write grant.
7. What goes wrong
The broad daily account is used
Symptom: authorization gives the connector everything the user can normally see, including unrelated calendars, folders, or queues.
Fix: stop and use a named training or task-specific identity restricted at the source. Client-side folder selection alone is not proof; directly test another valid-shaped resource and require forbidden.
The assistant's answer is inspected, but the call is not
Symptom: a plausible summary hides that the tool searched the wrong folder, sent a broad query, or returned more fields than needed.
Fix: open the call trace. Compare tool name, every argument, request ID, result fields, and error with the contract and source task.
A third-party connector is trusted by logo
Symptom: a similarly named publisher, marketplace listing, or endpoint from a message is authorized without checking ownership or updates.
Fix: start from the approved catalog or official owner page. Verify publisher, endpoint, requested permissions, support route, and update channel before sign-in.
"Read-only" exists only in the prompt
Symptom: the prompt says not to write, but the discovered tool list includes create, update, delete, send, or administration.
Fix: disconnect. Require a profile in which unnecessary writes are not exposed and the server identity lacks write permission. Prove a write-shaped call is unavailable or denied.
Source permissions are assumed
Symptom: the connector claims it respects source access, but nobody tests a valid-shaped out-of-scope resource.
Fix: use an approved synthetic unauthorized ID. Require forbidden before any record data is returned, then have the source or connector owner investigate any leak.
A failed lookup becomes a broad search
Symptom: a wrong ID or empty result causes the connector to search another folder, queue, tenant, or the web.
Fix: require explicit invalid_input, forbidden, or not_found. No error may expand scope or guess a replacement resource.
The connector only moves the copying
Symptom: setup is complex, returned data is too broad, and the learner still copies every result between tools.
Fix: count the handoffs removed by one repeated task. Keep the connector only if it performs a current, bounded retrieval with better source evidence than the manual route.
Evidence exposes credentials or real records
Symptom: a screenshot includes a token, account email, unrelated tab, private event, customer detail, or production endpoint.
Fix: revoke exposed credentials and follow the local incident route. Repeat only in the synthetic sandbox, crop to the approved call view, and verify that no secret is displayed before retaining evidence.
8. Do it yourself: connect one live task in 60 minutes
Choose the Lab or Company framing. Use only the pre-provisioned Coordination Sandbox or an equivalent approved synthetic tenant. Do not connect a production account, add a network endpoint, or add a write tool.
Minutes 0-8: write one repeated lookup in a single sentence. Name the identity, exact read operations, allowed calendar/folder/queue, expiry or end time, owner, and revocation route. List every action that must remain impossible.
Minutes 8-16: inspect the connector's approved catalog entry. Verify publisher, connection identity, fixture owner, synthetic environment, requested resources, operation scope, expiry, and revocation route. Cancel if the entry and consent screen disagree.
Minutes 16-24: authorize the selected pre-provisioned sandbox profile. Reopen the discovered tool list and disconnect if it contains anything beyond the declared reads. Do not add an endpoint or credential manually.
Minutes 24-34: run the allowed prompt. Approve only after reading each tool name and argument. Inspect each returned field and request ID. Verify the assistant's final IDs, dates, status, and links against the visible tool results.
Minutes 34-44: run the denied tests in the approved inspector or test view: one malformed date or ID must produce an explicit validation failure; one valid-shaped out-of-scope resource must be forbidden; one absent in-scope record must be reported as not found. Confirm that no error broadens the search.
Minutes 44-51: request a write that fits the domain, such as moving an event, deleting a document, commenting on a ticket, or closing it. Confirm that no write tool is discovered and direct invocation is unavailable or denied. Refresh the allowed record and check the fixture owner's test view to prove that synthetic state did not change.
Minutes 51-56: decide whether the connection is worth retaining. Name the repeated copying step removed, any manual handoff that remains, and why leaving the final update to a person is appropriate. If the connector adds authority without removing a stable seam, revoke it.
Minutes 56-60: prepare one evidence screenshot from your successful live run. Show the assistant's completed task and expand one tool call so its tool name, synthetic arguments, bounded result, and request ID are visible. Hide unrelated panels and confirm that the image contains no personal data, account identifier, endpoint, or secret. Revoke or disconnect the exercise profile after capture.
9. Exit check
Deliver exactly one artifact: one evidence screenshot showing the assistant completing the chosen synthetic task through a live connector call, with one call expanded to show the tool name, arguments, bounded result, request ID, and source IDs used in the answer.
It passes when the visible arguments name only the approved synthetic resource, the result contains only declared fields, the assistant's answer can be traced to the returned source IDs, and no credential, personal data, production endpoint, or unrelated account detail appears. The allowed run is eligible for capture only after validation-failure, forbidden, not-found, and unavailable-or-denied write tests have passed and no synthetic state changed. A screenshot of prose without the call, a configuration screen without a completed live task, or several separate files does not pass.
10. Rule to remember
Read what it sent, not just what it said.
11. Further reading & tools
- Taught: Connect an AI assistant to your workplace tools - defines a narrow MCP tool boundary, scoped authorization, minimal results, and explicit denied outcomes.
- Taught: Skills, tools & extensions - separates reusable instructions from callable authority and server-enforced controls.
- Catalogued: Every n8n connector - index - reference index for evaluating one exact connector operation, credential boundary, trigger or action, and execution trace; no connector build is required here.
- Taught:
T02-L02| Your daily driver - chooses an approved assistant and establishes its workspace and data boundary. - Taught:
T05-L02| Automations with AI in the middle - treats assistant output as untrusted and separates internal preparation from consequential action. - Catalogued: Model Context Protocol specification, stable 2026-07-28 revision (opens in a new tab) - the current official stable protocol revision, verified 4 September 2026.
- Catalogued: MCP tools specification, 2026-07-28 (opens in a new tab) - official definitions for discovering and calling tools, including the warning that tool annotations are not inherently trusted.
- Catalogued: MCP authorization specification, 2026-07-28 (opens in a new tab) - official requirements for protected remote MCP servers and authorization flows.
- Catalogued: Official MCP SDK overview (opens in a new tab) - current SDK tiers and official documentation. It is reference material only here; Level 3 learners do not install an SDK or build a server.
- Catalogued: MCP Inspector (opens in a new tab) - official source and release guidance for an optional, organisation-approved test view; it is not required or taught as an installation task here.
- Catalogued: NIST SP 800-53 Rev. 5 (opens in a new tab) - primary control catalog covering least privilege, access enforcement, input validation, and audit records.
- Catalogued: n8n built-in integrations (opens in a new tab) - official current index for checking a connector's exact node and operation rather than relying on its service name.
- Catalogued: Tools index - compare current approved connector options only after defining the identity, resource, operation, time, and revocation boundaries.