Official capabilities first.
Verify vendor APIs, licence tiers, rate limits, sandbox availability and permission scopes. A legacy system may require a narrower export-based workflow or prevent an implementation entirely.
Connected carefully.
Controlled deliberately.
Your diagnosis records system categories. It does not grant access or prove that a named integration is supported.
Least privilege.
Keep credentials in designated secret storage. Separate test and production. Prefer read-only access initially and keep a clear revocation path.
People own commitments.
Agree approval requirements for messages, customer promises, bookings, refunds and pricing. Start with drafts where confidence or authority is insufficient.
Visible exceptions.
Missing data, expired access and vendor failures go to a named owner. Retries must be idempotent and costs bounded. No silent failure or hidden autonomous action.