Managed: from your console's enterprise Sources - one button per source, restricted to the owner and admin roles.
Self-host: on the command line - kastel connector <service> connect, one command group per source (connect, sync, gc, offboard).
The mechanism described here is the same on both sides. What changes is the surface.
The scope: what a human designated
Kastel only imports what a person explicitly authorized, never an automatic sweep of your organization. For Google Drive, that means the rights already set on each file of the connected account. For Notion, that means the pages an administrator shared with the integration - nothing else is even listed. For Slack, that means public channels by default, and a private channel only when you explicitly include it and then invite the connector into it.
Authorizing a source is therefore an administration gesture, not a setting that gets forgotten. Managed: restricted to the owner and admin roles. Self-host: whoever runs the connect command on the machine running your Kastel.
A 90-day window bounds what the first pass absorbs (self-host: configurable per connector, connectors.<service>.history_days in kastel.config.yaml, 0 = no limit). Managed consoles show a quote before launching the import: how many documents fall inside the window, how many stay out. A document older than the window enters the day it is next modified or reshared, never before.
What gets synced, and how often
Each connector only re-reads what changed since the last pass, never a repeated full sweep. The pace is a regular pass, not a live stream.
Content deleted or re-scoped at the source is detected on the next pass and retired from what your Kastel serves - never kept silently. Removing a file or page's sharing is enough to take it out of scope; content already ingested stays reachable to those who already had access until an erasure decision is made (next section).
Removing it cleanly: two different gestures
"Removing a connector" covers two gestures that should not be conflated, and Kastel keeps them distinct by construction rather than folding them into one convenient button.
| You want to | The gesture |
|---|---|
| Stop syncing and remove access, keeping what was already ingested | "Disconnect" in the console, or kastel connector <service> offboard |
| Actually delete what was already ingested | The erasure review (/erasures, free core, never gated) or kastel erase --connector <service> - a traced, sealed gesture restricted to the roles allowed to run it |
This is not added friction: it is what keeps an accidental disconnect from wiping out work already done, and what gives an actual erasure the sealed trail an irreversible act deserves.
Connectors documented today
Fifty-one other sources exist in the engine; their fiches follow, one chantier at a time, on this same template. To connect one before its fiche exists, the generic kastel connector <service> connect command already works on self-host, and the full catalogue stays visible from the enterprise Sources on managed.