> For the complete documentation index, see [llms.txt](https://docs.emseapea.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emseapea.ai/admin-guide/connectors.md).

# The connector allow-list

The allow-list is your organization's answer to "which systems may apps touch?" Each entry is a system key (e.g. `erp`) and a label (e.g. "SAP ERP").

Manage it in **Settings**. Changes take effect immediately: the request form's system picker reads the live list.

## What happens with systems NOT on the list

A builder can still *name* an off-list system in a request — deliberately so. The request is recorded and flagged **requires admin review**, every org admin is notified by email, and only an admin can decide it. Off-list requests are never silently granted and never silently dropped.

Even when an admin approves such a request, the issued credential is scoped to the **on-list systems only** — adding the new system to the allow-list first is the way to actually grant it.

For step-by-step vendor setup (Microsoft, Salesforce) and what each field means, see [Connecting a system](/admin-guide/connecting-a-system.md). For the accounts apps can be granted beyond just being on this list, see [Curating prepared accounts](/admin-guide/prepared-accounts.md).

## What being on this list does and doesn't mean

Being on the allow-list only means a system can be *requested*. It says nothing about whose data an approved app can see — that's decided per request, per system, by which kind of access was chosen (only what the signed-in person can see, or a prepared account) — see [The two kinds of access](/builder-guide/kinds-of-access.md). The reasoning for why Emseapea draws the boundary this way, rather than trying to enforce finer-grained rules itself, is recorded as **D7, "Fine-grained access scope,"** in the [product's architecture decisions](https://github.com/scmjea/emseapea/blob/main/docs/architecture.md) (engineering repo access required).