The agreement and the access grant are two different things
Sharing data between organizations starts with an explicit agreement about what's being shared, for what purpose, and under what restrictions — and the technical access grant that implements it is meant to reflect exactly that, not more and not less. Building the integration is often treated as the finish line, when it's really the point where the agreement's terms get translated into an actual technical boundary that has to keep matching those terms going forward.
The recurring gap is between what the agreement currently says and what the access grant actually permits: an integration built once, granting somewhat broader access than the agreement specified at the time, that nobody revisits as the underlying agreement is later renewed, narrowed, or ended.
Keeping the two in sync deliberately
Because nothing forces the technical grant to track changes to the underlying agreement automatically, keeping them aligned requires a deliberate practice: reviewing the actual access alongside the agreement's terms at renewal, and revoking access explicitly and immediately when an agreement ends, rather than leaving the integration running on the assumption that someone would have said something if it needed to stop.