Option D is the necessary first step because authorization and data suitability must be established before the shared source is connected to Claude. The team should verify that the connector and its provider are approved under organizational AI, security, procurement, and privacy policies. It must also determine the source’s data classification and whether information in that source may legally and contractually be processed through the connector.

Connecting the source first, as proposed in Option C, could expose restricted information before governance review has occurred. Testing a representative task under Option B likewise assumes that access has already been approved. Documenting the connector’s purpose and suitable use cases under Option A is important, but that operational documentation should follow the initial determination that the connector and relevant data are permitted.

After approval, the team can connect the source using an account with appropriate permissions, verify authentication, test access boundaries, and confirm that Claude retrieves only information available to the authenticated user. The team should then document approved use cases, prohibited data, human-review requirements, and reporting procedures. This sequence follows least-privilege and data-governance principles and avoids treating successful authentication as evidence that a connector is organizationally authorized or suitable for every type of information.