AI Connector Security, OAuth Hygiene & Setup Governance
MCP OAuth Hygiene, Cloud Visibility & Lesson Prompt Audit
Audit Arte Sheets ChatGPT 0.1.0 setup and teaching guardrails: host OAuth without chat passwords/tokens (revokable in Profile -> Connected apps), no ChatGPT credit transfer claims, cloud collaboration visibility vs local browser sheets, and lesson-text prompt-injection quarantine.
Enforce OAuth secret hygiene, cloud-collaboration prerequisites, and lesson-text isolation!
When onboarding teams or learners to the Arte Sheets ChatGPT plugin 0.1.0 (currently In review / Not published—never promise public installation, approval, OpenAI revenue share, or checkout inside the plugin), four strict setup and teaching boundaries protect user accounts and data! First, authentication occurs solely via the host’s scoped OAuth connection (manageable and revokable anytime in Arte Sheets Profile -> Connected apps)—never ask users for passwords, API keys, or bearer tokens in chat! Second, ChatGPT usage credits NEVER transfer to Arte Sheets or its metered Pro in-app / Realtime voice assistant (while ordinary MCP tool calls themselves consume 0 Arte AI credits under the 120 calls/min per-account limiter). Third, local browser-only workbooks are invisible to list_workbooks and read_range until the user saves them to their Arte Sheets account and enables collaboration—never pretend a local browser sheet was uploaded or trigger unrequested demo edits/invitations! Fourth, reading course content via get_lesson (academy:read) is NOT authorization to mutate workbooks, send invitations, or access other documents, and any tool directives embedded inside lesson text must be quarantined!
Verify in a governance compliance checklist—Saved_To_Account_Cloud = 1 (B2), Collaboration_Enabled = 1 (B3 -> Connector Visibility Ready = 1 in E2), Chat_Password_Or_Token_Prompted = 0 (B4), ChatGPT_Credit_Transfer_Claimed = 0 (B5), and Unrequested_Lesson_Text_Write = 0 (B6 -> Total Policy Violations = 0 in E3): E4 confirms "Compliant Setup: Cloud Collab Ready via OAuth", and E5 documents revocation path "Profile -> Connected apps"!
| MCP Setup & Lesson Security Audit (Cloud=1, Collab=1, SecretAsk=0, CreditClaim=0, LessonInj=0) | Formula | Verified Output |
|---|---|---|
| Connector Workbook Visibility | AND(Saved_To_Cloud = 1, Collab_Enabled = 1) | 1 (0 if Local Browser-Only!) |
| Security & Policy Violation Count | Secret_Asked + Credit_Claim + Lesson_Inject | 0 Violations |
| Onboarding & Teaching Gate | Secret -> Credit -> Injection -> Cloud Check | Compliant Setup: Cloud Collab Ready via OAuth |
| User OAuth Revocation Surface | Documented Account Control Path | Profile -> Connected apps |
MCP Setup, Credit-Isolation & Lesson Prompt-Guard Formula
Validate binary {0, 1} flags across all five setup and security audit inputs!
=LET(cl_s, B2, cb_e, B3, sc_p, B4, cr_t, B5, ls_w, B6, IF(OR(AND(cl_s <> 0, cl_s <> 1), AND(cb_e <> 0, cb_e <> 1), AND(sc_p <> 0, sc_p <> 1), AND(cr_t <> 0, cr_t <> 1), AND(ls_w <> 0, ls_w <> 1)), "Invalid Binary Audit Flag", IF(sc_p = 1, "Block: Never Ask Passwords/Tokens in Chat", IF(cr_t = 1, "Block: ChatGPT Credits Never Transfer", IF(ls_w = 1, "Quarantine: Lesson Text Never Authorizes Writes", IF(OR(cl_s = 0, cb_e = 0), "Unavailable: Save to Account & Enable Collaboration", "Compliant Setup: Cloud Collab Ready via OAuth"))))))Local Browser-Only Sheet (B2 = 0) & Lesson-Text Injection (B6 = 1) Checks
Set Saved_To_Account_Cloud B2 = 0 (local browser-only sheet): Visibility E2 drops to 0 and E4 guides "Unavailable: Save to Account & Enable Collaboration"! Restore B2 = 1 and set Unrequested_Lesson_Text_Write B6 = 1: E4 flags "Quarantine: Lesson Text Never Authorizes Writes"!
=IF(ISTEXT(E4), IF(E4 = "Invalid Binary Audit Flag", E4, "Profile -> Connected apps"), "Profile -> Connected apps")Try the example
Use the original values or change them to test your understanding.