Platform disclosure and reviewer kit.

Each scope is requested only after the owner connects their account and grants consent through Meta's authorization flow. No scope is used for purposes outside the conversation surface it was granted for. Laras is not a general-purpose AI assistant. It does not offer open-domain question answering, companionship, or arbitrary content generation to end customers. The AI is an ancillary drafting aid: it drafts business replies scoped to each inbound customer conversation, grounded only in the connected business's own catalog, prices, and policies, and sends them inside the platform's customer-service window after the owner's configured review rules.

1. 01

   Connect

   The business owner opens Settings, Integrations and connects their account. Instagram uses Meta’s OAuth authorization. WhatsApp pairs a phone_number_id from the Meta WhatsApp Manager. Tokens are stored in encrypted token storage.

2. 02

   Receive

   A customer messages the connected account. Meta delivers the event to Laras at the verified webhook (HMAC SHA-256 signature checked before processing). Laras routes it to the owning workspace.

3. 03

   Draft

   Laras drafts a reply scoped to that conversation using only the workspace’s own business context. A safety classifier inspects the draft for brand alignment and policy compliance before anything leaves.

4. 04

   Send

   If the owner enabled auto-send and the draft passes the classifier, Laras sends automatically inside the customer-service window. Otherwise the draft is held in the approval queue for manual review.

5. 05

   Arrives

   The reply is delivered through the official Meta API. Laras records the provider message ID and delivery status in the evidence chain.

6. 06

   Disconnect

   The owner can disconnect anytime. Tokens and account or number references are cleared immediately. Meta deauthorize and data-deletion callbacks clear the same data.

1. 01Sign in at /login using the test workspace credentials provided with the submission.
2. 02Open Settings, Integrations. For Instagram, click Connect and complete Meta’s OAuth with the test IG professional account.
3. 03For WhatsApp, open the WhatsApp Business tile and click "Connect WhatsApp via Meta" to launch Embedded Signup.
4. 04Complete the Meta popup: pick the test business, select or create the WABA, choose the test phone number, and approve the requested scopes.
5. 05On popup success Laras receives the short-lived authorization code plus session_info (waba_id, phone_number_id) and POSTs them to /api/wa/embedded-signup-callback. The server exchanges the code for a long-lived token and stores it with AES-256-GCM at rest. No token is logged or echoed to the browser.
6. 06Confirm the connected number appears on the WhatsApp tile and that inbound webhooks at /api/webhooks/wa route to the test workspace using its phone_number_id (per-tenant routing is keyed off the Meta-issued ID, not a shared inbox).
7. 07From an external account, message the connected Instagram account or WhatsApp number.
8. 08Observe the inbound message appear in the Laras inbox and a drafted reply generated.
9. 09Auto-send off: approve the draft and confirm delivery. Auto-send on: confirm automatic delivery inside the 24-hour window.
10. 10Click Disconnect and confirm the connection is removed and tokens are cleared.
11. 11Fallback paths to spot-check: (a) close the Meta popup before finishing. Laras shows "Signup was cancelled before it finished" and no row is written. (b) Let the session expire mid-flow. The Embedded Signup component clears its captured session_info on each new launch, so a stale waba_id never reaches the callback. In both cases the reviewer lands back on the Integrations page with no partial state.