Useful access without giving up control.

Every external AI action crosses authentication, permission, entitlement, brand-access, validation, and audit boundaries before reaching Wowly Studios data.

OAuth and identity

AI connections use OAuth 2.1 authorization-code flow with PKCE. Access tokens are checked for issuer, audience, signature, expiry, connection status, and the connected Wowly Studios user. Google sign-in authenticates the user; Wowly Studios never receives the user's Google password.

Least privilege

Connections carry explicit product permissions for brand context, brand details, assets, content, drafts, calendar events, verified facts, guidelines, publishing, and analytics. Tool calls that need a disabled permission are rejected.

Brand isolation

A valid brand_id never widens access. The server checks that the connected user can already access the requested brand, and database policies preserve that boundary.

Publishing is a two-step action

1. publications_schedule validates the brand, content revision, target account, local time, and policy warnings. It returns a preview and a short-lived confirmation token.
2. publications_confirm accepts that token only after the user has approved the preview and acknowledged its warning codes.

Rescheduling follows the same preview-and-confirm pattern. Cancelling stops an eligible scheduled job without deleting the content.

Safe writes and history

• Commands use caller-generated idempotency keys to prevent accidental duplicate writes.
• Mutable records use opaque concurrency tokens so stale updates fail instead of silently overwriting newer work.
• Draft updates create immutable revisions rather than erasing previous versions.
• Actions are recorded in a redacted audit trail visible in the Connections portal.

Media handling

Approved host-generated images can be transferred into Wowly-owned storage. Intake is HTTPS-only, rejects private and metadata network destinations, limits redirects and time, enforces a 10 MB streaming limit, validates PNG/JPEG/WebP bytes, hashes the content, and removes partial staging objects after failure.

Untrusted content

User-authored brand descriptions, facts, guidelines, and other stored text are treated as data—not as system or tool instructions. Tool schemas label these fields so compatible hosts can preserve that boundary.

Review, revocation, and deletion

Users can inspect permissions, recent actions, last-use time, and connection status at connections.wowlystudios.com. Revoking a connection blocks future calls. Account deletion removes external AI authorizations along with the account data described in the Privacy Policy.

Report a security concern

Email hello@wowlystudios.com with “Security” in the subject. Include the affected account email, connection name, approximate time, and a description. Do not send passwords or access tokens.