{
  "title": "AI assistant permission first review",
  "status": "Proposed worksheet; no live Xero permission or disconnection tests were performed",
  "limit": "An initial review, not a complete security assessment. Never place tokens, secrets or customer records in this worksheet.",
  "blank": {
    "organisation": "",
    "app_identity": "",
    "authorising_account": "",
    "operational_owner": "",
    "readable_data_and_scope_breadth": "",
    "writable_actions": "",
    "expected_denials": "",
    "approval_boundary": "",
    "audit_evidence": "",
    "revocation_procedure": "",
    "verification_results": "",
    "unanswered_questions": ""
  },
  "worked_example": {
    "organisation": "Illustrative wholesaler",
    "app_identity": "Xero custom connection",
    "authorising_account": "To verify in actual settings",
    "operational_owner": "Finance lead; name required before use",
    "readable_data_and_scope_breadth": [
      "accounting.invoices.read",
      "accounting.contacts.read",
      "accounting.reports.aged.read",
      "Scopes are not confined to overdue invoices"
    ],
    "writable_actions": "None in Xero; local unsent drafts only; no email connection",
    "expected_denials": [
      "record payment",
      "raise credit note",
      "change contact email",
      "read payroll"
    ],
    "approval_boundary": "Finance lead checks invoice, balance, age and recipient, then copies and sends herself",
    "audit_evidence": "Request identity, source invoice state, proposed draft, review decision; minimise retained data",
    "revocation_procedure": "Named owner disconnects via supported provider controls, stops job and removes retained credentials",
    "verification_results": "NOT RUN: harmless read with retained access token; new token request; four denials and positive lookup",
    "unanswered_questions": [
      "Actual scopes granted, including legacy broad scopes",
      "Provider attribution in history",
      "Credential storage and retention",
      "Disconnection behaviour for existing access"
    ]
  }
}