Grant access

This is the one place to give AOS the outside access it needs. Add each access as a managed secret (it is never shown back to you or pasted into chat), and it switches on the moment it arrives. Nothing here charges or changes anything outside — access only lets AOS read, or act later on your yes.