What you can connect

Agents holding a connection can read without asking. Everything they propose to write or send waits for a person’s approval, given at the time or, for some changes, in advance. See Approvals.

Microsoft 365: Read email, calendars and files, and Teams channels. Proposes: send email, create calendar events, post in Teams channels.
Google Workspace: Read Gmail, calendars and Drive files. Proposes: send Gmail, write Gmail drafts, create calendar events.
Slack: Read channels and messages, look up people. Proposes: send messages.
Salesforce: Read clients, contacts and the pipeline. Proposes: create tasks.
Jira and Confluence: Read Jira work and Confluence pages. Proposes: comment on and create Jira issues, create Confluence pages.
HubSpot: Read contacts, companies and deals. Proposes: create contacts.
Xero: Read invoices and clients. Proposes: create draft invoices, which an agent can never approve or send.
DocuSign: Read the status of signatures. Proposes: send documents for signature.
Notion: Read pages. Proposes: add to pages.
Zoom: Read meetings, and see that recordings exist without their contents. Proposes: schedule meetings.
GitHub: Read code, pull requests with their checks, and issues. Proposes: comment on pull requests, create and comment on issues, propose code changes.

GitHub works a little differently. See GitHub. Coding agents such as Claude Code connect to Arbituro itself, over MCP. See Connect Claude.

Make a connection

Open Settings, and under Connections choose New connection.
Choose what it connects to.
Choose whose it is: yours, or the workspace’s.
Tick what agents holding it may do. Reading is ticked to start and writing isn’t, except for Microsoft 365 and Google, where nothing is ticked to start.
Choose Sign in with the service, and sign in to it in the window that opens, within 15 minutes.

Anyone in the workspace can make a personal connection. A workspace connection needs an owner or admin.
The connection signs in through Arbituro’s own app for that service, your workspace’s sign-in app, or an app of its own. If none is available for a service, or for some of its actions, the form says so.
Each connection’s row in Settings shows whose it is, who approves what leaves through it, which agents hold it, and when it was last used. A connection held but unused for over a month is marked idle.

Personal and workspace connections

Personal: Your own account, such as your mailbox. Only you see it, it can go only to your private agents, and only you can approve what is sent through it.
Workspace: An account the organisation shares, such as a support inbox or the company CRM. Everyone in the workspace sees it, and it can go only to agents everyone can use.

The person who makes a connection owns it. Only they can change, share, disconnect or delete it.

On the connection’s page, choose Share it with an agent or a person. Give an agent one of two levels:

To read: The connection’s reading tools, which run without asking.
To draft: Reading, and every other action ticked on the connection. Each of those waits for approval.

An agent can hold one connection for each service.
To change a share’s level, stop sharing and share again.
Stopping a share applies from the agent’s next action, including actions already approved that haven’t run.
A request to share a connection for drafting reaches its owner in Your turn.

Who approves

On a workspace connection, the owner and every person they share it with to sign can approve what agents send or change through it. On a personal connection, only the owner can. People who sign must also be members of the job’s project.

The owner can also approve some kinds of change in advance, for up to 90 days. Messages are never approved in advance. See Approval in advance.

Change, hand on or delete

Change what it may do: Changing the ticked actions or the sign-in details disconnects it, and the owner signs in again. GitHub is the exception.
Disconnect: Removes its sign-in. The agents and people it is shared with keep their shares, ready for when it reconnects.
Hand it on: Gives the connection to someone else, who signs in again. Its shares stay, and what was approved in advance through it ends.
Delete: Removes the connection, its shares, and what was approved in advance through it.

Disconnecting or deleting doesn’t withdraw the access you granted at the service itself. To end that too, revoke Arbituro’s access in the service’s own settings.

Someone who still owns connections can’t be removed from the workspace until those are handed on or deleted.

Some organisations require their own registered app for a service, such as their own Salesforce connected app. Workspace owners and admins add one in Settings, under Connections, then Sign-in apps: the client ID, the client secret, and an optional default tenant.

It replaces Arbituro’s app for every connection to that service in the workspace, personal ones included.
The secret is stored encrypted, never shown again, and never sent to the browser.
Removing it moves connections back to Arbituro’s app when they next refresh, or stops them if there is none.

Slack for briefs and digests

Adding Arbituro to Slack is separate from a Slack connection. Workspace owners and admins add it in Settings, under Briefs and digests, so morning briefs arrive as Slack messages and project digests can post to a channel. Agents can’t use it. Nothing in Slack approves anything: its buttons open Arbituro.

Something missing or wrong? Email support@arbituro.com.