What Cascade supervises, and which tools it is allowed to run unattended.
Must be https. A credential does not belong on the wire in clear.
The name, not the value. Put the credential in Secret Manager yourself; it never travels through this form.
Cascade will run this tool and then its inverse against one real record, and check the state came back. Until this passes, the tool is treated as irreversible.
The arguments for one real record on this connection. It will be modified and put back.
Excused from the comparison. Naming a field here is a claim that it does not matter, and it is recorded with your name.