> For the complete documentation index, see [llms.txt](https://docs.notionapps.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.notionapps.com/automation/security-and-permissions.md).

# Security and Permissions

## Security and Permissions

Automation should respect the same role and data boundaries as the rest of the app. A workflow is not customer-ready if it only works for the app owner.

### Permission questions to answer

* Who can start the workflow?
* Who can see the source record?
* Who can receive the work?
* Who can act on the Decision screen?
* Who can see the Work Queue?
* Who can see Workflow Status?
* Who can see Conversation messages?
* Who can repair exceptions?
* Who can publish changes?

### Role testing

Test with the least-privileged role that should use each step. If the owner can see everything but the reviewer cannot, the workflow is not ready.

### Common permission failures

| Failure                              | What happens                              | Fix                                             |
| ------------------------------------ | ----------------------------------------- | ----------------------------------------------- |
| Recipient lacks screen access        | The item routes but screen appears empty. | Grant screen visibility to the recipient role.  |
| Recipient lacks source record access | The item appears but cannot open.         | Update data restrictions.                       |
| Requester cannot see result          | User thinks the process disappeared.      | Show source status or Workflow Status.          |
| Maker lacks exception access         | Failures cannot be diagnosed.             | Grant Exception Resolution to maker/admin role. |

### Safe default

Give users only the screens and records they need. Give makers validation and exception access. Give admins repair and publish access.