If a Partner Manages Your Workspace
Approve, narrow, or revoke a partner’s delegation grant in Team settings → Governance. Direct workspace memberships are managed separately under Members. For existing workspaces, you review the request and can lower the tier before accepting. Partner-created workspaces start with an active full-operational grant so setup can begin right away.
- Use it to
- Review a partner access request, toggle impersonation consent, downgrade an active grant to Read only, end sessions, or export the Governance audit trail
- Find it
- Team settings → Governance (client workspace Admin)
- Limits
- 1 governing partner practice at a time · Up to 100 automations on an automation-scoped grant
- Output
- Immediate session revocation on tier downgrade or End management · CSV audit trail export (Time, Event, Event key, Actor, Detail)
- Instead
- Members & Invitations (to review or remove direct workspace memberships held by partner accounts)
Deciding on a request
Requests arrive by email and appear in Team settings → Governance. Opening the email link does not commit a decision; only workspace Admins can act. Review these four terms, then click Allow access or Decline:
| Term requested | Your control |
|---|---|
| The tier: read-only or full operational | Accept or downgrade to read-only. You cannot raise it above the request. See Access Tiers. |
| The scope: whole workspace or named automations | Pick up to 100 automations on a scoped request. Ask for a new request to narrow a whole-workspace ask. |
| Impersonation: acting as one of your admins | Controlled by Allow time-boxed impersonation (off by default, available only at full operational). |
| The duration | Shown in days; starts when you accept. A pending request expires after 14 days without a decision. |
Review data access alongside credential controls. Grants block creating, removing, or re-authorizing app connections and revealing stored secrets. However, an impersonation session can edit or delete automations, files, variables, and secrets (including rotating values), and run automations with existing connections. Full-operational access shows Step results and errors in scope (with stored secrets redacted automatically). Read-only access shows operational summaries only. Store credentials in Connections or Secrets, and exclude sensitive automations from scoped grants. See Access scope.
Ongoing control
Open Team settings → Governance. Only workspace Admins see the grant, sessions, and audit trail or change access. Other members see the overview and capability table only. Glow emails Admins asynchronously when an impersonation session starts and ends.
What Admins Can Review
-
Live sessions: operator, start time, reason, scheduled expiry, and End session.
-
Provider card: current tier, expiry, grant origin, Change tier, and End management.
-
Impersonation & history: the Allow impersonation switch, session log, and past grants.
-
Audit trail: governance events and CSV export.
Routine handover
Before a planned engagement ends, confirm five handover items:
- Monitoring: Assign someone to watch the Execution Log and verify outcomes in destination apps.
- Notifications: Confirm alert recipients and responders. Failures do not notify your team unless configured.
- Connections: Record each app connection’s owner for reconnection and plan replacements if they leave.
- Billing: Identify your billing administrator. If another account sponsors the workspace, coordinate with its payer administrator; see Sponsorship & Changing Payer.
- Access paths: Review both the delegation grant and any direct Members entries held by the partner.
Do not delay urgent revocation. If access is unwanted or compromised, revoke it immediately below.
Four controls for reducing or ending access
| Control | Stops immediately | Leaves in place |
|---|---|---|
| End session | One live session, after confirmation | The grant and consent for future sessions |
| Allow impersonation (off) | All live sessions and permission to start new ones | The grant and console visibility |
| Change tier → Read only | Full-operational access, impersonation consent, and all live sessions | An active read-only grant |
| End management | Delegated access through the grant and planned automation transfers | Audit history, automations, and any direct partner memberships |
Lowering a tier, disabling impersonation, or ending management ends affected live sessions immediately. Revocation does not roll back external changes or cancel in-flight runs; inspect active runs and destination systems separately.
- Stops delegated access, console visibility, active sessions, and planned transfers.
- Delivered automations stay in your workspace for your members to run and maintain.
- Continued execution still requires Live status, valid connections, funding, and capacity.
- Removes partner accounts that hold direct Admin, Manager, or Member roles.
- Required for partner-onboarded workspaces where the creator also received Admin membership.
- Removing a member alone does not end an active delegation grant.
Grants that never showed you a consent screen
Check the origin on your status card in Team settings → Governance:
| Origin on status card | Why no consent screen appeared and initial tier |
|---|---|
| Invited by request | You approved the request on the consent screen and chose the initial tier. |
| Workspace created by [partner] | Created by your partner or signup link; starts at Full operational without a separate screen. |
| Pre-existing management | Migrated from an earlier management relationship. |
| Assigned by Glow | Configured by Glow support at the request of an authorized workspace administrator. |
Regardless of origin, a client Admin can lower the tier, disable impersonation, or end management anytime. Resuming management requires a new partner request.
- Run
- Open Team settings → Governance as a workspace Admin
- You should see
- You can view the active partner grant, toggle Allow impersonation, change the tier, end sessions, or export the audit trail.
What’s Next?
- Governance & Impersonation: capability matrix, scope rules, and impersonation audit details.
- Security & Compliance: workspace-wide security and access controls.
- Members & Invitations: manage direct team roles separately from partner grants.