APIs and connectors
Protect connector credentials with least privilege
Scope machine identity, secrets, permissions, rotation and emergency revocation around the actual workflow.
Build idempotent webhooks, retries and reconciliation
Accept duplicate and delayed delivery without repeating side effects or losing work between systems.
Define an API contract and field mapping before integration
Make identifiers, meanings, validation, ownership and change behaviour explicit before connecting systems.