Connections, tools, and agent authority
Declare Connections and tool authority in Builder settings so compile can prove each stage is allowed to call what it calls.
Last updated September 27, 2026
What to declare
Connections and Governance are Builder settings. Stages do not receive tools at runtime unless compile recorded the authority to use them.
Declare:
- each external connection a stage may use
- the actions and resources those connections may touch
- the principal that owns the action (human, App, or agent)
Canon fails closed when a stage references an undeclared connection or an unresolved principal.
Agent stages
Agent stages run in GitHub Actions, not in Designer. If a stage uses GitHub Copilot CLI, the organization must enable Copilot and Copilot CLI / coding-agent policy for the workflow actor. Otherwise the job fails with Access denied by policy settings. Canon cannot change that org policy.
The live Canon GitHub App must be installed on the bound repo. Privileged jobs expect the production OIDC broker to mint operation-scoped installation tokens. Preview App credentials or a preview backend are not a substitute.
Authority that compile rejects
@code-ownerand other placeholders used as principals- empty production reviewer lists on an enforced package
- human gates with no resolved reviewer
- tools that have no matching Governance action
Fix the Blueprint settings and compile again. Do not patch generated workflow YAML to grant extra tools.
After install
Connection secrets belong in GitHub environments or repository secrets, not in the exported package and not in a Human Review Task. Re-export if you change Connections; then Start Run on the new package.