Connector scope and delegated administration
Constrain hosted authority and distinguish local access from hosted account ownership.
Connector delegation limits which hosted regions and resource classes a self-hosted organization can manage through a linked hosted account. Local role bindings cannot expand that hosted grant.
Grant the hosted scope
In the hosted organization, open Organization settings → Connector grants and review the requesting installation. On the self-hosted side, open Installation settings → Connectors → Connector → Project bindings.
A hosted organization administrator reviews the requesting installation identity, local organization ID, allowed regions, resource classes, and spending controls. The accepted grant records both organizations and the Connector identity.
The local administrator then binds permitted projects to that grant. A project needs local resource permission, local region admission, and hosted grant access for a request to succeed. Failure at any boundary rejects the action.
Read and write delegation
A Connector can be granted read access without creation permission. The local console can then display linked hosted inventory but cannot mutate it. Granting a local Project Operator role does not convert a read-only hosted grant into write authority.
Do not share a Connector credential across independent installations. Each installation needs its own grant and audit identity so revocation can target one management boundary.
Narrow or revoke a grant
Removing a region prevents new actions that require that region's authority. Existing hosted resources are not deleted. Read and cleanup permissions must remain sufficient for the approved decommissioning or ownership-transfer process.
Revocation can leave local operations reconciling until an authorized hosted operator inspects their result. Record hosted operation IDs before changing the grant during an incident. Resource usage can continue after the local installation loses access.
Transfer administration
When another installation will manage the same hosted resources, use the hosted ownership-transfer procedure. Pause competing automation, resolve in-flight operations, grant the new identity, and verify resource mappings before revoking the previous grant.
Importing the same display names into a second installation does not establish shared ownership. Only one supported management authority should issue lifecycle changes for a given delegated resource set.
Audit correlation
Local audit records identify the requesting member or service account and the Connector reference. Hosted records identify the delegated installation and hosted resource IDs. Preserve both request identifiers for a cross-boundary investigation.
Use Connector API for scope inspection, API authentication for local machine credentials, and data residency for allowed locations. Network connectivity between local and hosted workloads remains a separately configured path.