Augment integration

2. Connection and scope

Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.

Account-wide Augment API key

An Augment account manager supplies a long-lived key and enables webhook management for the intended brokerage. The credential is account-wide and write-capable even though Seedling exposes no business-data mutation.

Connection ownership

This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.

3. Augment data Seedling accesses

Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.

Observed loads

Minimized current load state retrieved by exact load number after a supported webhook event; there is no historical enumeration.

Progress and exceptions

Regional tracking and stop progress, ETA changes, carrier issues, and approved workflow summaries without precise location or contact details.

Lifecycle evidence

Allowlisted event identity, minimized durable receipts, Seedling-owned webhook configuration, prospective cursor, bounded failures, and exact source provenance.

4. Read-only permission contract

Augment currently provides an account-wide credential rather than a truly read-only key. Seedling compensates with a checked-in outbound allowlist and an explicit administrator acknowledgement.

• Verification and exact current-load retrieval are the only supported business-data API reads.
• Webhook endpoint and subscription create, inspect, repair, and delete calls are allowed only for Seedling-owned callback configuration.
• No load, stop, rate, carrier, contact, document, issue, bid, draft, or workflow business-data write is implemented or exposed.
• Seedling excludes historical enumeration, deletion-by-absence, rates, precise GPS, addresses, contacts, recordings, files, and unrestricted custom fields.

5. Security and access

• Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
• Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
• Workspace objects begin with no human audience. A current workspace owner or source steward must assign the provider-defined scopes for this exact connection to active members; membership, administrator or steward status, installer identity, and provider roles grant no raw-content bypass.
• The public webhook authenticates the provider bearer secret, validates the exact workspace route and allowlisted event envelope, stores minimized receipt data before enqueue, and treats payload state only as a hydration hint.
• The connector remains pilot-gated until provider identity, live/test hosts, webhook behavior, rate limits, provider-side disconnect, production callbacks, monitoring, privacy, security, evaluation, rollout, and rollback are externally verified.
• Generated output cannot bypass Seedling's human review, verification, and approval gates.

6. Retention and deletion

Connected data

Synchronized Augment records remain while the connection is active and are removed through a durable integration purge after disconnect.

Credentials

Stored Augment credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.

Backups

Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.

7. Installation, help, and removal