Security and approvals

Integration responsibilities

• Store tokens and client secrets only in server-side secret storage.
• Use exact HTTPS redirect URIs and validate OAuth state.
• Request the smallest practical scope set.
• Keep tenant/workspace context explicit.
• Verify webhooks before parsing their JSON.
• Preserve evidence and approval handoffs.
• Support immediate disconnection and revocation.

Fullness responsibilities

Fullness enforces release gates, grant and workspace binding, policy, approvals, evidence, idempotency, revocation and prohibited-tool boundaries inside the execution path shared by API and agent protocols.

Trust and service health

Security, privacy, compliance and assurance material belongs in the Fullness Trust Center. Live availability and incidents belong on the status page.

Report a security issue

Do not include credentials or sensitive financial data in an ordinary documentation email. Use the responsible-disclosure contact published by the Trust Center.