innovation register

{
  "id": "P11-I-001",
  "source_ids": [
    "P11-I-R-2",
    "P11-I-R-1"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Server-side idempotency keyed per tenant and connector with request fingerprinting",
  "claim": "The highest-consequence must-build. Key store, SHA-256 request fingerprint so a reused key with a mutated payload is a hard error, optimistic locking for concurrent replays, TTL, and an explicit replay receipt header. Every action declares its idempotency class and the runtime refuses to auto-retry the unsafe class, defaulting to unsafe when undetermined.",
  "precedent": "Stripe is the fully specified positive control, read this run. No production OSS supply exists: the most-starred idempotency-key middleware found is 14 stars and hono-idempotency is a specification to reimplement, not a dependency. Across the commercial survey no embedded-iPaaS or agent-action vendor documented a write idempotency-key contract.",
  "limitations": "Whether the class can be derived at catalogue-import time for a useful fraction of 1,445 providers is an open question",
  "rank": 1,
  "disposition": "top10"
}

{
  "id": "P11-I-002",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Idempotency layer positioned inside the rate limiter and auth check",
  "claim": "Ordering is load-bearing, not an implementation detail. If the rate limiter runs first, a throttled request can produce a different result under the same key, and the key's safety guarantee silently does not apply.",
  "precedent": "Stripe documents exactly this hazard in its own API: a request rate-limited with a 429 can produce a different result with the same idempotency key because rate limiters run before the idempotency layer. The same applies to a 401 with a missing key and most 400s with invalid params.",
  "limitations": "Placing idempotency inside auth means unauthenticated replays are not deduplicated, which is correct but must be stated",
  "rank": 2,
  "disposition": "top10"
}

{
  "id": "P11-I-003",
  "source_ids": [
    "P11-I-R-7",
    "P11-I-R-8"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Outbound token broker with per-tenant-per-connector custody",
  "claim": "Storage, auto-refresh, rotation and instant revocation for many long-lived third-party tokens. The caller passes an identity, never a secret; the broker injects credentials server-side so generated app code and model context never hold a third-party token. Refresh 15 minutes early under a lock keyed by tenant and connection, discriminating invalid_grant (user's problem, mark the connection ERROR) from invalid_client and invalid_scope (our bug, must not mark the connection bad).",
  "precedent": "Identified as a genuine OSS gap: every mature project runs the opposite direction, since oauth2-proxy guards inbound access, Hydra makes you an authorization server and Dex federates identity. Identity-not-secret is the most consistent finding across the commercial survey.",
  "limitations": "Refresh semantics for the OAuth callback path remain untested locally; the 27 Aug spike proved URL generation but not callback completion or refresh",
  "rank": 2,
  "disposition": "top10"
}

{
  "id": "P11-I-004",
  "source_ids": [
    "P11-I-R-7"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Tenant-keyed connection store with per-tenant key derivation",
  "claim": "Tenant column from the first migration, per-tenant key derivation, stable externalId as the reference rather than a UUID or display name, envelope encryption with AAD asserting purpose and app so a wrapped key cannot be replayed elsewhere.",
  "precedent": "The falsifier already fired: OpenConnector keys connections on (service, connection_name) with no tenant column, keys OAuth client configs on service alone, uses a hardcoded salt, silently degrades to plaintext without the env key, and returned two named tenants' connections together under one admin token.",
  "limitations": "Retrofitting is a storage-layer fork; this is why it must be owned from the start rather than adopted",
  "rank": 3,
  "disposition": "top10"
}

{
  "id": "P11-I-005",
  "source_ids": [
    "P11-I-R-13"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Dry-run as a non-disableable first-class action mode",
  "claim": "Return the exact resolved outbound request that would be sent, with empty results and no side effect, on by default and forceable by the action author so a tenant cannot disable it.",
  "precedent": "Zapier preview_only, the best single primitive found in the commercial survey. Caveat: Zapier AI Actions is documented as no longer developed or supported, so this is a pattern to study rather than a dependency.",
  "limitations": "A dry run cannot predict provider-side validation that depends on server state",
  "rank": 4,
  "disposition": "top10"
}

{
  "id": "P11-I-006",
  "source_ids": [
    "P11-I-R-16"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Unified per-tenant action-attempt ledger",
  "claim": "Every attempt, retry, idempotency replay, policy denial and approval in one queryable trail, with receipts that deliberately exclude payload bodies.",
  "precedent": "Receipts-excluding-payload is a convergent commercial pattern; Stripe's Idempotent-Replayed header is the machine-readable replay receipt to mirror",
  "limitations": "Excluding payloads limits post-incident forensics, which is the deliberate trade",
  "rank": 5,
  "disposition": "top10"
}

{
  "id": "P11-I-007",
  "source_ids": [
    "P11-I-R-10",
    "P11-I-R-12"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Egress allow-list derived from the connector manifest and bound to an enforcing proxy",
  "claim": "Supply the enforcement half that policy engines lack, with live revocation so disabling a connector takes effect immediately rather than at cache expiry.",
  "precedent": "OPA and Cerbos decide but neither enforces; no surveyed project ships the pairing for tool calls. Both MCP-safety gateways are weak bets, one roughly 7 months stale at 385 stars and the other aimed at LLM routing.",
  "limitations": "Latency cost of the proxy per action is unmeasured",
  "rank": 6,
  "disposition": "top10"
}

{
  "id": "P11-I-008",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Named connection selection with no ambient authority",
  "claim": "When a tenant holds several accounts for one provider, the action must name which connection it uses. Silent selection is a defect class.",
  "precedent": "Pipedream silently picks the most recently created account, documented in the commercial survey as a live ambient-authority hazard",
  "limitations": "Requires every action invocation to carry a connection reference, which is friction the hazard justifies",
  "rank": 7,
  "disposition": "top10"
}

{
  "id": "P11-I-009",
  "source_ids": [
    "P11-I-R-11"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Consent graded by consequence with policy on action payload",
  "claim": "Three tiers (read, reversible, irreversible-or-financial) defaulting to the middle, with policy evaluated over the payload itself (amount, recipient, record count) and a human-approval branch above a per-tenant threshold, expressible as a composable workflow step.",
  "precedent": "OpenAI's Always ask / Any changes / Important actions defaulting middle; Workato is the only surveyed surface where approval is a workflow step rather than a platform modal",
  "limitations": "Classifying 15,156 actions by consequence is not automatic; default to the stricter tier",
  "rank": 8,
  "disposition": "top10"
}

{
  "id": "P11-I-010",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Browser connectors as a separate authority class",
  "claim": "Browser automation must not inherit the API connector's authority model, because its credential is a replayable session blob rather than a scoped token.",
  "precedent": "Browserbase Contexts deliberately defeat the no-persistence default by replaying cookies and tokens with MFA completed once and reused, a durable bearer credential outside any scope or revocation model, with added ToS exposure from stealth and IP-rotation features",
  "limitations": "Splitting the authority model complicates the connector contract, which is the price of not laundering a bearer blob through it",
  "rank": 9,
  "disposition": "top10"
}

{
  "id": "P11-I-011",
  "source_ids": [
    "P11-I-R-5",
    "P11-I-R-6"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Per-tenant-per-connector fair-share rate limiting with provider-signal backoff",
  "claim": "One tenant cannot exhaust a shared third-party quota; backoff honours Retry-After and observed 429 rates per connector rather than a fixed exponential curve.",
  "precedent": "Good per-process rate-limit libraries exist; nothing is shaped as per-tenant-per-connector quota",
  "limitations": "Fair-share requires a shared quota service, adding a coordination dependency",
  "rank": 11,
  "disposition": "register",
  "demotion_note": "Demoted to reach exactly 10 top10. Ranked below the others because a tenant exhausting a shared provider quota degrades service, whereas every top10 item above prevents an incorrect or unattributable side effect. Promote once multi-tenant action volume is real."
}

{
  "id": "P11-I-012",
  "source_ids": [
    "P11-I-R-3"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Effectively-once composition",
  "claim": "Transactional outbox for delivery plus a consumer-side idempotency gate, since at-least-once delivery alone never reaches once.",
  "precedent": "Mature pattern; pairs with P09-I-006",
  "limitations": "Spans P09 and P11, so ownership of the outbox must be explicit",
  "rank": 11,
  "disposition": "register"
}

{
  "id": "P11-I-013",
  "source_ids": [
    "P11-I-R-14"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Signed connector manifests with provenance checked at load",
  "claim": "Fill the trust gap the MCP registry leaves open.",
  "precedent": "MCP has discovery without trust: the registry carries no signing guarantee that a listed server is the code it claims and no runtime permission model; reference servers assume a single trusted local operator with no tenancy",
  "limitations": "Signing requires a key-distribution story Actionist would own",
  "rank": 12,
  "disposition": "register"
}

{
  "id": "P11-I-014",
  "source_ids": [
    "P11-I-R-9",
    "P11-I-R-15"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Capability-binding execution with tiered sandbox selection",
  "claim": "No ambient network or filesystem, only injected capabilities; sandbox tier selected per action from its manifest (isolate for trusted, gVisor for semi-trusted, microVM for arbitrary).",
  "precedent": "workerd's binding model is the most portable idea in the sandbox category; e2b-dev/infra carries the Firecracker layer with plumbing attached",
  "limitations": "Sandboxing is P14's territory; listed here because action execution crosses the boundary",
  "rank": 13,
  "disposition": "register"
}

{
  "id": "P11-I-015",
  "source_ids": [
    "P11-I-R-17"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Webhook ingest with signature verification and operator-triggered replay",
  "claim": "Durable capture of inbound callbacks with replay, covering the half Svix does not.",
  "precedent": "Svix covers sending; Convoy covers both and is ELv2-blocked, which is precisely what makes it dangerous as the best functional fit",
  "limitations": "Inbound ingest widens the attack surface and needs its own tenancy model",
  "rank": 14,
  "disposition": "register"
}

{
  "id": "P11-I-016",
  "source_ids": [
    "P11-I-R-4"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Durable execution as an embedded library rather than a server",
  "claim": "Keep the runtime deployable as one artifact by preferring a library-shaped durable-execution engine over a server with its own persistence and matching tiers.",
  "precedent": "DBOS is the lightest seam surveyed (durable workflows as a library over Postgres, no server process); Hatchet is the step up when a real queue is needed; Temporal was demoted for footprint despite being MIT and most proven",
  "limitations": "Open-core scope for Hatchet and DBOS is unestablished; whether their MIT trees exclude paid-cloud features is a per-feature question the licence does not answer",
  "rank": 15,
  "disposition": "register"
}

{
  "id": "P11-I-017",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Catalogue state flags so a listed integration is never mistaken for an executable one",
  "claim": "Keep catalogue-only, needs-credential and locally-executable distinct, enabling a large browsable catalogue where only some entries are wired without lying to the agent about what it can call.",
  "precedent": "Carried from the 27 Aug connector research as the right primitive for filling a catalogue incrementally; lazy executor loading serves 1,445 providers without importing 1,000 modules at boot",
  "limitations": "Requires discipline at import time to set the flags honestly",
  "rank": 16,
  "disposition": "register"
}

{
  "id": "P11-I-018",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Generated setup forms from constrained provider schemas",
  "claim": "Render every connector's credential step from data rather than maintaining one component per connector.",
  "precedent": "Nango's SimplifiedJSONSchema covers 434 providers with title, description, example, pattern, order, secret, prefix, suffix, enum, per-enum warnings and visible_when conditional fields. Read the format, populate our own; ELv2 forbids vendoring the file.",
  "limitations": "The marquee providers are disproportionately the fiddly ones: 17 of Nango's 36 popular providers are scripted versus 9 percent across the catalogue",
  "rank": 17,
  "disposition": "register"
}

{
  "id": "P11-I-019",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Scope-aware action gating",
  "claim": "Surface per-action requiredScopes against the connection's grantedScopes to enable reconnect-with-more-scopes, and capture a CredentialProfile at connect time so the UI can say who an action runs as without exposing the token.",
  "precedent": "OpenConnector CredentialProfile auto-resolved during the spike; Activepieces getConnectionIdentifier makes a connection read as a person and workspace rather than an opaque id",
  "limitations": "Depends on providers exposing a cheap identity endpoint",
  "rank": 18,
  "disposition": "register"
}

{
  "id": "P11-I-020",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Fail fast on ambiguous or unsafe configuration",
  "claim": "Refuse to boot on mutually exclusive credential configuration rather than silently choosing, and never degrade to plaintext storage.",
  "precedent": "Nango throws when both ENCRYPTION_KEY and ENCRYPTION_KEY_WRAPPED are set; OpenConnector makes the opposite choice and silently returns a plaintext codec when the key is unset, with insecure self-hosted configuration explicitly out of scope for its vulnerability reports",
  "limitations": "Fail-fast increases deployment friction, which is the correct direction here",
  "rank": 19,
  "disposition": "register"
}

{
  "id": "P11-I-021",
  "source_ids": [],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Connect-session token with origin-checked postMessage handshake",
  "claim": "Server mints a short-lived token scoped to allowed integrations per customer; the iframe is created without the token in the URL, the child posts ready, the parent verifies event.origin and only then posts the token, keeping secrets out of browser history, referrers and access logs.",
  "precedent": "Nango Connect Session and connectUI handshake, read as a pattern; convergent with the P10 two-token finding",
  "limitations": "Study-only source under ELv2; reimplement rather than adopt",
  "rank": 20,
  "disposition": "register"
}