Connections give Hava read-only access to current business state. They are separate from approved Knowledge and from write Capabilities.
Hava supports validated HTTPS JSON endpoints over GET, with optional server-side encrypted Bearer authentication. Owners can validate and test a connection before Hava may use it.
For a question requiring current data, Hava may invoke the validated connection as a model tool. Business Preview exposes live-source provenance such as Live: Inventory API and the server records connection id, status, latency, and time without logging customer prompt or response contents.
Private/local network targets are blocked, redirects are rejected, responses are size/time limited, and write methods are not supported. Connecting data never authorizes Hava to mutate it.
Bearer credentials are never published in the browser-readable deployment document. Authenticated connections work in owner Preview/Test today; customer-facing deployment requires the private server connection vault before that credential can be used publicly. Unauthenticated approved HTTPS JSON endpoints can run in deployed Hava now.