Constrain user-data retrieval to a declared purpose

A developer guide to requester identity, subject scope, minimal fields, provenance, retention, and truthful errors for an access path that has not been approved.

Educational research only. LinkedIn account access remains decision-gated. No DewEngine LinkedIn connector is approved or implemented.

Talk to us ↗Read technical guides →

Terminology

Define whose data and which relationship

User data can mean the connected account owner's profile, another observed professional, relationship context, conversations, posts, or customer-derived notes. These categories are not interchangeable. Write a subject and requester model before an endpoint schema. DewEngine has no released LinkedIn retrieval API; profiles and related resources remain targets behind the legal and provider authorization gate.

Name the requester, data subject, account, and purpose
Avoid broad user objects that mix unrelated privacy contexts

Authorization

Enforce customer role and provider scope together

A workspace member may access a CRM contact without controlling the provider account that observed it, or may control an account without permission to view candidate records. Both checks matter. Resolve tenant role, record relationship, connected-account ownership, product entitlement, and approved resource operation for every read. Guessing a resource ID must never widen access.

Deny cross-account and cross-workspace substitutions
Test permission changes while paginated reads are in progress

Minimization

Return fields for the screen, not an archive

A profile badge may need a name, role context, source, and freshness. A conversation view needs separately authorized message access. Do not bundle relation graphs, posts, jobs, or messages into every profile response. Minimal resource endpoints reduce accidental exposure and let customers issue narrower keys or agent scopes. Secondary enrichment and model training require independent review.

Use sparse field selections only when their semantics are stable
Keep sensitive message access outside routine identity reads

Truth model

Preserve observation state and uncertainty

Fields should carry source and observed time, while the resource carries coverage and account health. Missing can mean not requested, unsupported, inaccessible, redacted, or absent. A retrieval failure should return a stable class such as gated, unauthorized, not found, stale, or temporarily unavailable without exposing provider secrets. It must never replace a stored customer record with an empty object.

Differentiate provider fact from customer and derived values
Expose stale coverage without claiming current synchronization

Lifecycle rights

Make correction, export, and deletion addressable

Store data inventory and provenance so the operator can locate a subject's normalized records, raw observations, cached projections, exports, and audit metadata. Corrections may preserve a historical observation while changing the active customer view. Deletion must follow controller instructions and documented exceptions. Disconnect should stop future collection even when retention permits some prior business records to remain.

Track downstream copies by purpose and tenant
Verify account removal fences scheduled refresh work

Release proof

Require privacy and conformance evidence together

Before exposing a retrieval method, the product needs qualified legal review, provider authorization, eligible-account tests, least-privilege scopes, partial-field fixtures, tenant and cursor isolation, retention, export, correction, deletion, restriction, and support redaction. Documentation must list what is actually returned for each product. Until then, developers should treat this route as a requirements framework, not an integration endpoint.

Test data-subject lookup without global identity leakage
Keep a dated manifest of released fields and purposes

Questions

Before you build.

Is a connected account owner allowed to retrieve every profile they can name?+

That cannot be assumed. The approved provider contract, product entitlement, customer purpose, subject context, and privacy obligations determine a read. A URL or name alone is not authorization.

How can an API support deletion without losing all auditability?+

Delete or anonymize personal content and source payloads according to policy while retaining minimal non-content security facts where lawfully required, such as that an authorized deletion completed at a given time.

Build with us

Does this match the workflow your users need?

DewEngine is in development. Real use cases decide what ships first.

Share your use case ↗