Skip to main content
Chatbot can use live external systems, but Connections are private by default. Public access has separate policy and approval gates because a tool safe for an authenticated support agent is not automatically safe for an anonymous website visitor.

​
Public SOURCE connections

For an eligible SOURCE connection, open Connections and configure website chat access. The guided public-source editor lets you define:
  • which Widgets may use the connection;
  • minimum visitor identity tier;
  • the one tool/capability being exposed;
  • each allowed public input;
  • how each input is populated; and
  • output bounds.
After that, an administrator must still approve the Connection under Library → Shared Knowledge. Both gates must pass.

​
Eligible public SOURCE types

Current public-source capabilities include:
  • structured JSON API lookup;
  • live web lookup; and
  • approved MCP SOURCE tools.
Direct public API Connections must be read-only HTTPS GET requests. The public projection only exposes the single approved SOURCE tool and constrains its input/output schema.

​
Minimum identity tier

Public SOURCE policy can require:

​
Anyone chatting

No identity verification. Use only for information genuinely safe to show to any visitor.

​
Visitors who verified their email

The visitor must complete the widget’s one-time email-code flow before the source becomes available.

​
Visitors signed in on your site

Your website provides a server-signed identity token. Use this tier when customer-specific claims are required. Visitor identity →

​
Public input bindings

A public-source input can come from:
  • Visitor input — the caller supplies the value;
  • Fixed value — an administrator-defined constant; or
  • Signed customer field — an allowlisted claim from host-signed identity.
Every input has a bounded type/validation rule. Arbitrary visitor-provided inputs require an explicit safety attestation in the public-source policy because they expand what the remote service can be asked to retrieve.

​
Output bounds

Public source output is structurally bounded before it is returned to the Chatbot pipeline. The policy limits output size, nesting depth, and item count rather than allowing an arbitrary remote response to become public model context.

​
Shared Knowledge approval

After the connection policy is valid, open Library → Shared Knowledge. The Connection must be Approved for Chatbot there too. If the connection is unreviewed, in Draft, blocked by readiness errors, inactive, not targeted to the widget, or requires a higher identity tier than the session has, the public pipeline fails closed.

​
Public ACTION connections

State-changing customer actions use a separate fail-closed policy from SOURCE access. A public ACTION policy includes:
  • enabled state;
  • READ or WRITE classification;
  • required identity tier;
  • explicitly declared bounded inputs;
  • optional host-claim mappings;
  • localized customer confirmation text;
  • per-minute rate limit;
  • execution timeout;
  • idempotency requirement; and
  • mandatory audit logging.
Only ACTION Connections can use this policy.

​
Public WRITE requirements

A WRITE action must:
  • require host-signed identity;
  • require idempotency;
  • use a state-changing HTTP method rather than GET;
  • have customer confirmation copy;
  • accept only declared, validated inputs; and
  • be audited.
The browser confirmation request itself must explicitly declare confirmation and include an idempotency key. The server rechecks the connection, Chatbot approval, policy, session identity, inputs, rate limit, and idempotency before dispatching the request.

​
Public READ action

An ACTION connection classified as public READ can use GET and may require a lower identity tier, but it remains under the public ACTION policy and audit path rather than being treated as a normal SOURCE.

​
Current configuration surface

The standard Connections UI currently provides the guided public SOURCE policy editor. Public ACTION policy is a separate backend-enforced configuration. If an ACTION Connection does not already have a valid public-action policy, Shared Knowledge marks it as not ready for public approval. Assistant-side autoApprove or ACTION settings do not make it a public Chatbot action. This distinction is intentional. Please resist the ancient software ritual of assuming a hidden checkbox somewhere must make a refund endpoint safe for the internet.

​
MCP servers

Only eligible approved SOURCE MCP capabilities are projected into the public source path. An internal MCP ACTION tool is not made public by the SOURCE policy.

​
Simulation

Chatbot Simulation can exercise the full public reasoning path but always intercepts public ACTION tools. It records the proposed action and provides no confirmation endpoint, so the write cannot execute. Simulation →

​
Public action audit retention

Confirmed public-action attempts create audit records with their identity tier, bounded inputs, outcome, and retention expiry. The retention period is configured separately from ordinary conversation retention. Retention & deletion →