You want to avoid protocols with limited implementation, poor documentation, and, when possible, components involving human intervention.

It may not be possible to provide secure access through a fully mechanized protocol like HTTP, for example, for highly sensitive data. However, the protocol  must be clear and explicit in the metadata, whether it involves a verbal request, email, telephone number, Slack username, et cetera.

The important thing is that the communication protocol for how to access is explicit and clearly defined in the metadata, whether fully mechanized or not.