Social tokens are bearer credentials. Treat them like payment instruments: least access, encrypted at rest, never logged in full, and rotated when staff churns.
- Bind tokens to tenant + channel + page ID in SQL; delete quickly on offboarding.
- Automate refresh jobs; page SecOps if refresh fails three times consecutively.
- Run tabletop exercises: leaked token, rogue post, API deprecation mid-campaign.
AI automation that posts on behalf of brands should require human approval queues until confidence scores hold for months.