Read vs. write, kept separate

• - These are outbound — they hold a write credential and push data to external systems.
• - Cloud/SaaS connectors that only read evidence in (AWS, Azure, Okta…) live on the Connected Apps page and never carry write scope.
• - Credentials are encrypted at rest and never returned to the browser.