Skip to main content
Integration access scoping lets you lock down sensitive connections, like production AWS or Okta, so that only workflows in specific packages can use them. Within those packages, only the people on the access list can publish or test-run the workflows.
Integration access scoping is opt-in. Every workflow starts in its team’s Default package and every connection starts open, so nothing changes until someone with the Manage integration access permission restricts a connection.

​
How it works

A package groups workflows with the connections they’re allowed to use. Restricting a connection to one or more packages changes which workflows can use it and who can publish the workflows that depend on it:
  • Workflows in a linked package keep access. When a workflow picks a connection automatically, it prefers one that’s linked to its package.
  • A workflow that isn’t in a linked package can’t use the connection. What happens depends on how the workflow reaches for it:
    • If it explicitly targets the connection, the run fails to start, and the error names the connection and the package.
    • If it would only pick the connection up automatically, the run leaves the connection out instead of failing.
    • If the connection is passed in by an ID, it’s refused when the workflow tries to use it.
  • Publishing and test-running drafts are gated; editing isn’t. For a package that links a restricted connection, only people on its access list can publish or test-run its drafts. Ordinary edits still follow your team’s normal workflow permissions.
Serval’s health checks and built-in provisioning keep working on a restricted connection.

​
Set it up

You need the Manage integration access permission to restrict a connection.
1

Create a package

Go to Settings → Integrations → Packages and select Create package, then give it a name.
2

Give the package access

On the package, select Edit access and add the people or groups who should be able to publish and test-run its workflows. A package with no one on its Has access list can’t keep a restricted connection, so set this before you restrict.
3

Link the connection to the package

Open the connection, go to its Settings tab, and in Integration access choose Only workflows in these packages. Select Add to package… to link the connection to the package or packages that should keep access. Review and restrict… stays unavailable until you link at least one package.
4

Review and restrict

Select Review and restrict…. The preview lists the Packages that keep access and the Workflows that lose access. Move any workflow that still needs the connection into a linked package, then confirm with Restrict connection.

​
What people see when access is refused

When a workflow is refused for using a restricted connection, the error names the connection. When the refusal is because the workflow isn’t in a linked package, it also names the package to move the workflow into. The owner can then move the workflow into a linked package, or ask someone on that package’s access list for access.