# Telemio agent instructions — Security and credentials

Review a Telemio integration for least-privilege access. Separate OAuth/MCP user authorization, workspace read credentials, server ingest secrets, and browser-safe ingestion keys. Keep tokens in a trusted secret manager, never source code, chat, logs, or Zap step output. Verify workspace isolation, revocation, error handling, and minimal data export before using a third-party system.

Reference: https://telemio.sh/docs/integrations/security.html