Document permissions for a business automation owner
In this article (4 sections)
An owner cannot assess automation risk from a diagram that says “connected to accounting.” The permission register must show which identity can perform which operation.
Remove an unnecessary write
The automation lab evaluates three fixture permissions.
from automation_cases import permission_case
result = permission_case()
assert len(result["enabled"]) == 2
assert result["unneeded_enabled"] == []
assert result["shared_credentials"] is False
assert result["review_date"] == "2026-12-20"The workflow keeps inbox read and reviewer approval, while the unneeded accounting write is disabled. No identities were created.
Build the register
For each connection record business owner, technical owner, service identity, system, tenant/environment, scopes/actions, data classes, credential location, creation/expiry/rotation, approval dependency and last/next review. Link the workflow nodes that use it.
Use separate identities per environment and workflow boundary. Prefer narrow OAuth scopes or service roles, never a shared employee password. Store secret references rather than values in the workflow export. Remove old connections after testing and offboarding.
Review when a connector, tool, owner or process changes and at a fixed cadence. Test denied paths and cross-tenant IDs. Monitor use of sensitive scopes and reconcile the register with platform connections.
The Generative & Agentic AI course connects least privilege to owner-readable governance.
Exercise
Inventory one automation’s identities and scopes. Delete or disable one unnecessary permission, execute positive and denied tests, and obtain owner acknowledgement without exposing secrets.
Continue learning
This article is part of the Business automation with AI sequence. Use the neighbouring tasks when you need the prerequisite or the next application.
- Review the prerequisite or neighbouring task in Turn a spreadsheet process into an auditable AI workflow.
- Continue with Plan a handover for a no-code AI automation.
Reference: OWASP Top 10 for LLM and GenAI Applications.
Pankit Kumar has 10 years in Data Science & AI, building and shipping production systems in regulated pharma and clinical environments. He is a freelance trainer at Boston Institute of Analytics, AnalytixLabs and Scaler, and has taught this material to thousands of working professionals.
This article is part of our Generative & Agentic AI programme — 3 months. Add practical GenAI, retrieval and agent-building skills to your existing toolkit.
Explore Generative & Agentic AI