memories/ai-operations-credential-and-api-access-provisioning-c79452bc.md

memory

Purpose

Provide a compact reference for handling scoped API keys, platform credentials, cloud access, and related provisioning requests.

Classification Logic

  • API-access request: Raw API keys or service credentials for applications, scripts, or time-boxed projects.
  • SaaS-access request: Personal tool seats (e.g., [[Claude]], [[ChatGPT]]), licenses, or domain access. Route via appropriate SaaS process and budget owner.
  • Recurring needs: Evaluate for managed budget pools or service-account patterns.

Provisioning Flow

  1. Confirm: Project, business justification, audience, touched systems/data, duration, and owner.
  2. Scope: Minimize scope; determine risk level (Low vs. Security/Legal review needed).
  3. Issue: Enable scoped credentials with explicit expiration/rotation expectations.
  4. Deliver: Use secure channel/secret store; never commit to source, prompts, tickets, or shared docs.
  5. Record: Document outcome, owner, scope, and renewal/revocation expectations.
  6. Revoke: Clean up credentials upon project/event conclusion.

Guardrails

  • Global/org-wide tokens are prohibited.
  • Separate coding-harness use cases from in-application integrations.
  • Flag privacy/security concerns for sensitive data (customer, candidate, employee).
  • Prefer personal or project-scoped credentials over shared ones.
  • AI Operations does not unilaterally grant budget/seats for SaaS tools (e.g., [[Claude]], [[ChatGPT]]); use formal paths.

References

  • [[AIPM Playbook: LLM API Key & Cloud Credential Provisioning]]
  • [[AIPM Playbook: Glean API Token / Credential Self-Service Provisioning]]
  • [[AIPM Playbook: Claude/ChatGPT Seat, License & Domain Access Requests]]
  • [[AI Use Policy — 2025]]