Governance & Impersonation
Manage client workspaces through a time-boxed delegation grant with client-approved tiers, scope, and audited impersonation. Direct workspace membership is separate. Partner-created workspaces start with an active full-operational grant. For existing workspaces, a client Admin approves the tier, scope, and duration first, and can lower or end access anytime in Team settings → Governance.
- Use it to
- Manage delegated access tiers, automation scopes, grant durations, and time-boxed admin impersonation
- Find it
- Clients → Settings → Client access
- Limits
- 1 active session per operator · 15, 30, or 60 min sessions · 20+ char reason · Up to 100 scoped automations
- Output
- Dual-attributed audit trail entries and async session notifications to client Admins
The grant lifecycle
A grant has two live states; other statuses mark how it ended.
Two states are live; the rest are final. Choose a transition to see who moves the grant and what it means. Accepting is the only step that grants anything.
One partner governs a workspace at a time. Accepting a grant declines competing requests and ends any prior grant. A pending request expires after 14 days without a decision.
Requests email client Admins and wait in Team settings → Governance. Only Admins can review grants, act on requests, or view the audit trail. Accepting or declining emails the operator. Ending a grant keeps recent audit entries in Governance, not as a permanent archive.
Access tiers
Partners request a tier. Clients can accept or downgrade it, never raise it. Lowering an active grant via Change tier → Read only ends live sessions immediately and disables impersonation consent while keeping read-only access. Restoring full access requires a new request; impersonating operators cannot alter the grant.
- View automations, runs, failures, members, and credit usage.
- Receive alerts without viewing raw Step payloads or editing workflows.
- Copy automations, resolve alerts, and inspect Step results in scope.
- Delete resources or impersonate an Admin when separately allowed.
| Capability | Read-only | Full operational |
|---|---|---|
| View automations, executions, failures, members, credits | Yes | Yes |
| Receive alerts about this team | Yes | Yes |
| Copy automations into or out of this team | No | Yes |
| Acknowledge or resolve alerts, operational actions | No | Yes |
| Impersonation as a team admin | No | Only if separately allowed |
| Reveal Step result and error payloads | No | Yes, within scope |
| Delete automations, files, or variables | No | Via permitted actions or impersonation |
| Change billing or membership, delete workspace | No | Not via grant or impersonation |
| Create, remove, or re-authorize connections; reveal secrets | No | Not via grant or impersonation |
Credential controls do not hide all data. Operators cannot create, remove, or re-authorize connections, or reveal stored secrets. Impersonation can still manage variables and secrets and run automations with existing connections. Full-operational access shows Step results and errors in scope (redacting stored secrets automatically); read-only shows summaries only. Keep credentials in Connections or Secrets and exclude sensitive automations from scoped grants.
Access scope
A grant covers the whole workspace or up to 100 selected automations.
- Every client automation is visible.
- Can create or deploy automations at Full operational.
- Files, variables, and connections stay available.
- Up to 100 automations picked by the client Admin on acceptance.
- Cannot create or deploy automations outside the consented set.
- Files, variables, and connections stay available.
Whole-workspace requests cannot be narrowed on the acceptance screen, and widening a list requires a new request. Since selection caps at 100 automations, use scoping to include specific automations rather than exclude a few.
Grant duration
Durations by Entry Point
| Entry point | Available durations | Default |
|---|---|---|
| Invite client → Add existing team | 30 days, 90 days, 6 months, Until revoked (2 years max) | 90 days |
| Clients → Settings → Client access → Request access | 30 days, 90 days, 180 days (optional note) | 90 days |
| Invite by email → New client workspace | Fixed 2-year full-operational grant | 2 years |
The duration starts on acceptance. Clients see a warning under 30 days remaining and receive an extend email after expiry.
Impersonation
Impersonation lets a practice Admin, Manager, or Member act as a client Admin in scope. It requires an active Full operational grant with Allow impersonation enabled.
Starting a Session
- Open the dialog. In Clients → Settings → Client access, open the client row menu and click Impersonate….
- Set identity, reason, and scope. Choose Act as admin and enter a Reason (20+ chars). Pick 15, 30 (default), or 60 minutes, and choose All workflows or Only specific workflows.
- Verify and start. Confirm with your password (and 2FA code if enrolled) or fresh IdP sign-in, then click Start session.
Operators run one session at a time across all clients, while teammates can work in other clients in parallel. Sessions can narrow the grant’s scope, never widen it.
Audit export
Client Admins can click Export audit trail in Team settings → Governance to download available Governance events as CSV. See If a Partner Manages Your Workspace for columns, exclusions, consent controls, Allow impersonation, tier changes, and End management.
- Run
- Open Clients → Settings → Client access and inspect an active client row
- You should see
- The row shows the approved tier, scope, expiration date, and whether Impersonate is enabled.
What’s Next?
👉 Your First Client Automation →: apply the grant and handover model to a complete rollout.
Share If a Partner Manages Your Workspace before asking a client to approve access.