Onboarding

Connect your systems

A run can only operate where it has approved access. Grant the smallest set the job requires, and name which system is the record.

Connections expand what a run can see and change. That is the point of them, and it is also the reason to grant them deliberately rather than in bulk.

Connect the repositories, documents, data, and business systems where the work actually lives. For each one, decide two things before the first run: whether the run may write as well as read, and whether this system is the record when another source disagrees.

Read and write are separate grants

Reading a CRM to score accounts is a different risk from writing scores back into it. Granting them together because it is convenient removes a control you will want later, and it makes the first review harder because every read looks like a potential write.

Give a recurring automation an explicit tool allowlist rather than every connection available to the organization. The automation runs unattended, so its blast radius should be narrower than a person's, not wider.

Name the system of record

Most disagreements between sources are not bugs. A CRM export from Tuesday and the CRM itself on Thursday will differ, and both are legitimately what they are. What matters is which one wins.

State the precedence in the request whenever two sources could reasonably disagree. If a stale workspace copy conflicts with the named authority, require the run to stop and surface the conflict rather than pick one.

Treat NetSuite as the system of record for invoice status.
The spreadsheet in the workspace is a working copy. If they
disagree, stop and show me both rather than reconciling to
the spreadsheet.

When a connection is missing

Say explicitly whether a missing connection blocks the job or permits a lower-quality fallback. A run that silently degrades to a worse method produces a result that looks the same and is not.

Require approval before a consequential workflow changes its execution path. Switching from an API to driving the same system through the screen is a reasonable fallback, and it is also a decision someone should make on purpose.

What to connect first

  1. 01The system that holds the recordThe CRM, ERP, ledger, or repository the job is ultimately about.
  2. 02The sources the job readsDocuments, exports, dashboards, and the tools that enrich them.
  3. 03The intake surfaceSlack, Linear, GitHub, or email, wherever the request already arrives.
  4. 04The review surfaceWherever the person who owns the decision already looks.