> ## Documentation Index
> Fetch the complete documentation index at: https://docs.glood.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and privacy

> What a connection can reach, what it refuses, and how to revoke it

## What a connection can reach

Two things, and their intersection is the ceiling:

<CardGroup cols={2}>
  <Card title="The organizations you ticked" icon="building">
    At the consent screen, when you connected. Not all of them by default, and
    never more than you ticked.
  </Card>

  <Card title="Your own role in each" icon="user-shield">
    It can do what you can do in that organization — no more. A permission your
    role lacks is refused for the assistant too.
  </Card>
</CardGroup>

An organization you left unticked is invisible to the connection. An
organization you join **after** connecting is not added automatically — the
assistant will tell you it exists and point you at where to add it.

## It cannot widen its own access

There is no tool that changes which organizations a connection reaches. Not a
restricted one, not an admin-only one — none.

<Warning>
  This is structural, not a policy. Because no such tool exists, **no instruction
  reaching your assistant can widen its access** — not from a web page it reads,
  not from a document you paste, not from anyone. Only you can, and only from the
  dashboard.
</Warning>

A connection that could widen its own access would not have access limits at
all.

## Shopify stays read-only

The connection can read your Shopify data through your store's own Admin API —
inventory, fulfilment status, metafields, order detail. It cannot write.
Mutations are refused on the parsed query, not guessed at from its text.

Customer identifiers are refused by name: email, phone, names and addresses are
not returned.

If something needs changing in Shopify, the assistant will tell you what and
where. You make the change yourself.

## Changes that ask first

Archiving an agent, stopping a deployment and removing a schedule are two-step.
The first call changes nothing and shows you a review of what would happen;
nothing happens until you confirm.

Every other change reads back a sentence naming the agent, the store and the
organization it acted on.

Findings are never applied or dismissed on the assistant's own initiative — only
when you ask, and the reason recorded is the one you gave.

## Token lifetimes

|               |                                                |
| ------------- | ---------------------------------------------- |
| Access token  | 1 hour, refreshed by your client automatically |
| Refresh token | 30 days                                        |

A connection unused for over 30 days expires. Reconnect from your client and
approve again.

## Privacy, plainly

The assistant sees whatever it reads on your behalf. **Those conversations live
with your AI provider**, under their retention policy, not ours.

On our side we record which tools were called and what they were asked, so
*"what did it actually look at"* is a question with an answer.

<Note>
  If that trade is wrong for a particular organization, do not share that
  organization with the connection. The consent screen is where you decide, and
  you can change it at any time.
</Note>

## Turning it off

**Account → Connections**, at
[app.glood.ai/account#connections](https://app.glood.ai/account#connections).

From there you can change which organizations a connection reaches, or revoke it
outright.

Revoking takes effect immediately and kills every credential that connection
holds, refresh tokens included. Reconnecting later starts a fresh approval.