API connection
Read-only or least-privilege access is requested for the approved tenant, account, subscription, repository or project boundary.
Recorded evidence
Secret Manager reference; authorised scopes; tenant and account boundary; authoriser; timestamp.