App Dependency Permission Manifest

How to use App Dependency Permission Manifest

An AI-built app can introduce packages and integrations without a complete operating handoff. Prepare a data-only manifest from package.json and the external connections you explicitly declare.

1. Paste your reviewed package.json without credentials.
2. Declare every external integration and its data, permissions, owner and approved/pending state.
3. Reconcile the manifest with actual deployed connections and a separate code/security review.

Good to know

• Strict JSON rejects duplicate keys, dangerous property names, depth over 12 and objects/arrays over 100 entries. No package is installed or executed. Dependency declaration presence does not prove runtime use.
• Each field is limited to8,000 characters and each CSV to100 data records. Use the exact displayed header; quoted commas, doubled quotes and quoted newlines are supported. IDs and short task descriptions are limited to 200 characters. Numbers use nonnegative ordinary decimal notation with at most 9 fractional places, magnitude at most 999,999,999; no scientific notation. Whole-count limits can be stricter. Results above 1 quadrillion or nonzero below 0.000000000001 are refused.
• Independent deterministic ToolJovia workflow. It does not call an AI model, contact a vendor, fetch sources, send messages, save input or execute code. Editable outputs and downloads contain your data; review before sharing. A prepared plan does not verify customers, revenue or a vendor’s internal workflow.