Know whose credential it is
An organization’s bot or service credential is different from a member’s password or one-time code. Members should never need to share those secrets in a support conversation.
Define the connection’s scope
Reading an enrollment status, locating an approved resource, and changing an access role require different permissions. Ask for the smallest access that supports the chosen workflow.
Keep technical commitments specific
Confirm the storage, processing, access, and rotation controls applicable to your setup with the team. General guidance here does not establish a particular encryption implementation or provider contract.
Review and rotate when needed
Keep credential ownership clear. If a credential is exposed or a responsible team changes, follow the provider’s rotation process and verify that the support connection still works.