Gusto system-token company provisioning and disconnection, occupation search, event polling, and webhook subscription administration. Generated from Gusto's complete 2026-06-15 App Integrations reference inventory: every admitted method/path is checked against its own official Markdown-wrapped OpenAPI fragment, with raw page and extracted-contract hashes retained in the audit fixture. A single openapi_source is intentionally omitted because Gusto publishes split per-endpoint fragments whose server is the demo origin; pinning one fragment would falsely claim production-wide coverage. This leaf is isolated to SystemAccessAuth operations and requires a separately enrolled short-lived Gusto system bearer; company OAuth tokens cannot authorize it. The X-Gusto-API-Version header is fixed to 2026-06-15. Every documented scope is declared and reads are uncached; sensitive payroll and HR reads are marked sensitive-read and require approval unless session-granted, while ordinary reads remain unheld. Mutations are grant-off and approval-gated, explicit-null and structurally unsafe request bodies fall back to bounded body_raw, and JSON unsafe integers remain exact strings. No work-entity Source is declared because the App Integrations surface exposes no semantically honest task, note, or project entity.