When we connected X to our bot fleet, the platform's review layer treated every call the same way. A bot reading its own mentions raised the same approval card as a bot posting. Inside a scheduled routine there is nobody to tap the card, so the morning mention sweep never ran.
The fix was not to grant a blanket allow. It was to find out what the connector could actually do.
Enumerate before you allow
We asked the bot to list every tool on the connector and split them by effect. Twenty-five tools. Twenty-two were reads: profile, timeline, mentions, post lookups, search, news, trends. Three changed the account: create bookmark, create bookmark folder, delete bookmark. Posting, replying, DMing, and following were not on the connector at all.
That last fact mattered most. A blanket allow could not have published anything, because nothing on the connector could publish. The worst case was an unwanted bookmark.
Allow the reads, keep the writes carded
We allowlisted the twenty-two reads by name and left the three bookmark mutations behind approval. The sweep runs unattended now. If a routine ever tries to bookmark, a card appears.
Add a spend rule
Read tools on this connector cost credits per result. A routine that runs every weekday with no ceiling will spend the balance quietly, and an empty balance looks exactly like a quiet week. We added a rule: no unattended run spends more than one dollar, report the balance in every daily summary, and stop and ask below five.
What to take from it
- Never allow a connector. Allow tools.
- Ask for the full tool list and split it yourself. The bot's summary of its own permissions is not the permission list.
- Check whether the dangerous capability exists on the connector at all before deciding how scared to be of it.
- Anything that spends money unattended needs a ceiling and a report.