Prepare access and permissions

Prepare access with the people responsible for each connected system. Start from the workflow's requirements and grant only the data and actions needed for the agreed outcome.

Identify system owners#

List the systems involved and the person who can approve access for each one. Record the environment, relevant records, and the intended identity or access model for review with your implementation team.

Follow your organization's approved credential and identity process. Do not put passwords, tokens, or private keys in workflow briefs or support messages. The authentication method is confirmed for the deployment and integration.

Separate read access from actions#

Create a short access inventory for each system:

• Which documents, records, or fields must the workflow read?
• Which outputs can it prepare without changing the source system?
• Which records or fields may it update?
• Which operations require a person's approval?
• Which information and actions are explicitly outside scope?

A user being able to view a record does not imply that every agent role may modify it. Review the identity, purpose, and operation together.

Prepare representative test cases#

Include authorized and unauthorized examples. Test that permitted information can be used, excluded information stays outside the workflow, and restricted actions follow the agreed review path.

Also test missing records, changed permissions, and conflicting ownership. Use approved test data and environments where available. Acceptance should cover both the result and the access behavior that produced it.

Keep access current#

Assign an owner to review access when people change roles, an integration changes, or the workflow expands. Agree how access removal and credential changes are handled and how their effects will be checked.

When an agent reports missing access, investigate the intended boundary before granting more permissions. The correct response may be to narrow the request or ask the record owner for an approved alternative. See Troubleshooting and support.