canva-policy-guardrailsImplement repository and runtime controls for Canva Connect authorization, secrets, previews, data, retries, and CI trust. Use when converting integration policy into testable deny-by-default checks. Trigger with: "add Canva guardrails", "lint Canva integration", "enforce Canva policy".
Independent GitHub snapshot · Automated classification · Original documentation governs
name: canva-policy-guardrails description: 'Implement repository and runtime controls for Canva Connect authorization, secrets, previews, data, retries, and CI trust. Use when converting integration policy into testable deny-by-default checks. Trigger with: "add Canva guardrails", "lint Canva integration", "enforce Canva policy".' allowed-tools: Read, Grep, Write, Edit version: 2.0.0 argument-hint: '[repository-path-and-policy-profile]' model: inherit effort: high license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags:
Encode high-confidence invariants close to the code and verify them again at runtime. Keep provider-dependent facts versioned so a stale numeric limit or preview assumption cannot become permanent policy.
Separate immutable security controls from versioned provider-contract checks and local operational thresholds. Name the authority for each.
Use Write or Edit to block client secrets/tokens in source, frontend bundles, logs, snapshots, artifacts, and untrusted CI; scan examples and failure paths too.
Require tenant/resource ownership, application policy, explicit minimum scopes, current capabilities, and preview status before dispatch.
Require operation identity for mutations, bounded retry classification, async job reconciliation, and scoped queues for throttling.
Pin OpenAPI or checksum, test unknown fields/statuses safely, detect deprecated/preview surface drift, and require review before regeneration.
Use Read and Grep to verify each rule fires on a failing fixture, cannot be bypassed by formatting, and produces a redacted reason with owner and exception path.
Make exceptions narrow, approved, time-bounded, visible in CI, and automatically fail after expiry.
Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.
A CI rule rejects Canva client secrets in browser configuration and privileged live tests on fork events; a runtime guard separately denies a design write without tenant ownership and explicit scope.
| Failure | Response |
|---|---|
| Rule depends on stale numeric limit | Move the value to a versioned contract fixture |
| Exception has no expiry | Reject it |
| Guard logs protected input | Return only a stable reason code |
| Static rule cannot prove runtime ownership | Add a runtime deny-by-default check |