Connector Exposures

An exposure is a saved, parameterized query against a connected data source. Once an admin approves it, an AI agent can call it as a tool (coming with skill binding) — but the agent only ever runs queries a human has authored and signed off. You reach exposures from Configuration > Connectors, then open a connector and choose its Exposures tab.

Who can do what

Operators and Reviewers have no access to the connector or exposure screens.

Authoring a query

1. Open the connector’s Exposures tab and choose New exposure. The connector must be probe-verified (green/active) before you can preview against it.
2. Write the SQL. Use a single SELECT. Reference inputs as named placeholders like :api or :since — never paste values into the query text.
3. Declare each parameter. For every :placeholder, add a param row with a name, a type (string, number, boolean, date, timestamp), and whether it is required. The name must match the placeholder.
4. Watch live validation. As you type, the editor checks your SQL and lists any problems — a non-SELECT statement, a second statement, a blocklisted function, or an undeclared :placeholder. Fix these before saving.
5. Browse the schema. The schema panel lists the tables and columns the connector can see, as an authoring aid. (It is a snapshot — the live preview is the real test of whether a table or column exists.)
6. Preview. Enter a value for each parameter and run a preview. Results are capped (at most 50 rows) and shown as a table; a caption tells you if they were truncated. Preview runs the query against the real source read-only, so it is the authoritative check that your query actually works.
7. Save as draft, then Submit for review when it’s ready.

The approval queue (admins)

The Approval queue tab lists exposures awaiting review. For each one you see the exact SQL that will be approved, its parameters and caps, and who proposed it. Read the query carefully — approving it authorizes that exact text to run against your source system.

• Approve — the query becomes eligible to be bound to skills. The approval is pinned to the exact SQL.
• Reject — send it back with a note explaining what to change.

You can Retire an approved exposure at any time to take it out of service. A connector cannot be deleted while it still has approved exposures — retire them first.

Binding an exposure to a skill

An approved exposure only becomes something an agent can call once you bind it to a skill. In the skill’s definition, a connector reference lists the exposures it binds (connector_key + exposures: [...], access read_only). When the skill loads, each bound exposure becomes an LLM tool named xq_{connector}_{exposure}, and the agent can call it to read live data.

Binding is validated when you save the skill: the connector must be active and read-only verified, and every listed exposure must be approved. If you edit an approved exposure afterwards it reverts to draft — its bound tool then quietly disappears from the skill until you re-approve it (the skill still loads; it just runs without that tool). A binding whose connector is later disabled degrades the same way, so an agent never silently returns stale or empty data in place of a real answer.

Write-back is not available: an exposure is read-only, and a skill cannot bind a read_write connector reference.

What is (and isn’t) recorded

Every authoring and review action is written to the audit trail. Query previews and runs are logged too — but only a hash of the parameter values, never the values themselves. Nothing you type as a parameter value is ever stored or shown to anyone else.