The controls sit in the service rather than in a wrapper around it, so they apply to every call.
Separated per app and per user
Every read is scoped to the calling app. A request for another app's or another user's item returns "not found". Stored source content never crosses from one app to another.
Retention you set
You set how long copies of items fetched from a connected account are kept: 90 days by default, shorter, longer, or no expiry. Derived information is kept until it is erased or the item is deleted. Erasure finishes within 30 days.
Every action on the record
Every action an agent takes for a user is written to a numbered record for the app. Export it as JSON or CSV for the app or for one user, with a check that nothing is missing or altered.