---
title: "Connector and Broker Policy Catalogue"
slug: "appendix-e-connector-and-broker-policy-catalogue"
kind: "appendix"
order: 27
label: "Appendix E"
letter: "E"
summary: "A starting catalogue of the systems a sovereign platform should reach through Model Context Protocol connectors, by sector, with the scopes a broker policy should distinguish and the audit fields e…"
words: 612
---

A starting catalogue of the systems a sovereign platform should reach through Model Context Protocol connectors, by sector, with the scopes a broker policy should distinguish and the audit fields every call produces. It is a template to be edited into the institution's own policy table, not a complete list.

## Audit fields every call produces

Whatever the connector, the broker writes one line per call with these fields. They are the minimum a regulator, an auditor or an incident review will ask for.

|Field|Content|
|---|---|
|`timestamp`|When the call was made|
|`user`|The person on whose behalf the call was made|
|`role`|The role the policy was evaluated against|
|`agent`|The agent that made the call|
|`surface`|Web, side panel, desktop, mobile, terminal, scheduled|
|`tool`|Connector and tool name|
|`scope`|The scope granted: self, caseload, department, organization|
|`parameters`|The call's inputs, with secret fields redacted|
|`decision`|Allowed or denied, and the policy rule that decided|
|`result_size`|Rows or bytes returned|
|`classification`|The data classification of what was returned|
|`model_target`|Which model later received the result, from the router|

## Higher education

|System|Example products|Read scopes|Write scopes|Classification|
|---|---|---|---|---|
|Student information system|Banner, PeopleSoft Campus, Jenzabar, Colleague|Own record (student); caseload (advisor); program (chair); all (registrar)|Holds, notes (registrar roles only)|Restricted (FERPA)|
|Learning management system|Canvas, Blackboard, D2L, Moodle|Own courses (student); taught courses (instructor); all (admin)|Announcements, grades (instructor)|Restricted|
|Recruitment and advancement CRM|Slate, Salesforce|Own territory (recruiter); all (director)|Notes, tasks|Confidential|
|Advising platform|EAB Navigate and equivalents|Caseload|Notes, alerts|Restricted|
|Ticketing and service desk|ServiceNow, TeamDynamix, Jira Service Management|Own tickets (requester); queue (agent)|Create, comment, resolve|Internal|
|Identity directory|Active Directory, Okta, institutional IdP|Own profile; lookup by role|None|Internal|
|Document stores|Google Drive, SharePoint, Box|Own and shared-with-me|Create in own space|Varies by item|
|Library and research databases|Discovery layers, publisher APIs|Catalogue search|None|Public|

## Enterprise

|System|Example products|Read scopes|Write scopes|Classification|
|---|---|---|---|---|
|CRM|Salesforce, HubSpot, Dynamics|Own accounts; team; all|Notes, tasks, opportunity fields|Confidential|
|ERP and finance|SAP, Oracle, NetSuite, Workday Financials|Own cost centre; department; all|Draft journal entries, approvals (finance roles)|Restricted|
|HR system|Workday, SuccessFactors, BambooHR|Own record; direct reports; all (HR)|Time-off requests|Restricted|
|Support desk|Zendesk, Freshdesk, Intercom|Own tickets; queue|Create, reply, resolve|Internal|
|Project and work tracking|Jira, Asana, Monday|Own projects; team|Create, update|Internal|
|Collaboration|Slack, Teams, email|Own channels and mail|Post, send (approval recommended)|Internal|
|Data warehouse|Snowflake, BigQuery, Redshift|Governed views by role|None|Varies by view|
|Contracts and documents|DocuSign, SharePoint, Box|Own and shared|Create drafts|Confidential|

## Healthcare

|System|Example interfaces|Read scopes|Write scopes|Classification|
|---|---|---|---|---|
|Electronic health record|FHIR APIs; vendor-sanctioned interfaces|Own patients (clinician); panel (care team); none (non-clinical)|Draft notes only, clinician review required|Restricted (HIPAA); local models only|
|Scheduling|Practice management systems|Own schedule; department|Requests|Restricted|
|Clinical documents|Document management|Own patients|None|Restricted|
|Billing|Revenue cycle systems|Department|None|Restricted|

Healthcare connectors should route exclusively to models on the restricted list, which in practice means local inference on institution hardware.

## Legal and financial services

|System|Example products|Read scopes|Write scopes|Classification|
|---|---|---|---|---|
|Matter and case management|Clio, iManage, NetDocuments|Own matters; practice group|Notes, drafts|Privileged; local models recommended|
|Document management|iManage, NetDocuments, SharePoint|Own and matter-shared|Create drafts|Privileged|
|Billing and time|Clio, Elite, Aderant|Own entries; partner view|Time entries|Confidential|
|Market and reference data|Vendor feeds|Licensed scope|None|Licensed|
|Research databases|Legal and financial research platforms|Licensed scope|None|Licensed|
|KYC, AML and compliance|Screening and case tools|Own queue; compliance team|Case notes, escalations (approval required)|Restricted|

## Writing the policy table from the catalogue

Each row above becomes several rows in the broker's policy table: one per role and tool, with the scope the role gets and whether the tool may write. Three rules keep the table honest.

- **Start empty.** Deny by default; add the first agent's needs; add the next agent's. The table should read as a history of deliberate grants.
- **Scope before allow.** Never grant a role "all" when "own" or "caseload" is what the agent needs. The source system's own permissions are the backstop, not the control.
- **Writes require an approval mode.** Any tool that changes a system of record should be paired with the ask-first approval mode in the harness, at least until the agent has an evaluation history.