Use MCP resources and HTTP manifests before browser automation. Current public reads are intentionally safe and redacted.
Never put admin secrets or bearer credentials into prompt-visible tool input. Private agent access is split into scoped grants, token exchange, revocation, and principal resolution.
Confirmed live schedule/status and lesson price writes are currently executable through scoped contracts. Billing, moderation, creator-speech, checkout, and preference writes stay unavailable until a manifest explicitly marks them ready and requires confirmation plus audit attribution.
ChatGPT app widgets and metadata should layer over the shared MCP contracts. They are not separate product contracts.