Step 1: list what the remit actually needs
Before touching any tool, read the remit's owns list and write, for each tool, the minimum access that list requires: read access to bank feeds and the ledger with the ability to propose entries for a Finance Controller FTE; read applications and schedule into calendars for a Recruiter FTE; draft in the helpdesk for a Customer Support FTE; open pull requests but not merge for a Content FTE. If an item on the list needs more access than the tool can scope, that item may belong on the escalate list instead.
The list is what security will check against, and it is shorter than most people expect.
Step 2: create a dedicated account or token at the tool
At each tool, create a dedicated account or API token for the Digital FTE rather than using a person's login. A person's login ties the FTE's access to that person's, cannot be revoked without affecting them, and makes every action in the tool's own logs look like theirs. A dedicated account can be revoked alone, appears under its own name in the tool's logs, and can be given exactly the permissions from step one.
Name it so that anyone reading the tool's audit log knows which role it is.
Step 3: grant the narrowest permissions the tool allows
Grant the account the permissions from step one and nothing more, using the tool's own permission model: read-only where reading is enough, propose or draft where the FTE proposes, and never post, send, merge, delete, or administer unless the remit requires it and the platform will gate it. The permission at the tool is the strongest control available, because it holds even if everything else failed.
Where a tool's permissions cannot be narrowed enough, note it; the remit will restrict what the FTE reads and acts on within the connection, enforced by the approval gate, and the quarterly review will revisit it.
- Read-only where reading is enough
- Propose or draft where the FTE proposes
- Never post, send, merge, delete, or administer by default
- Note any tool that cannot scope finely enough
Step 4: connect in Setup, scoped to one property
In the Digital FTE's Setup tab, add the connection for the specific property it serves. The credential is encrypted before storage with a key held separately from the data, never appears in a response, a log, or the workspace after entry, and is listed in the connection list with the role, the property, and the date. A role serving two properties gets two connections, and neither reaches the other's data.
Connector links that expose the FTE to an external assistant follow the same rule and are shown exactly once.
Step 5: have security confirm the scope at the tool
Before the first proposal, have the security lead or whoever owns access confirm, at the tool rather than in the workspace, that the account's permissions match step one. It takes minutes. Record the confirmation with a name and date in the security checklist. This is the check most organizations skip and the one that decides the blast radius of a bad day.
If a broader grant was made in a hurry to get started, this is where it is narrowed.
Step 6: review every connection quarterly
Every quarter, alongside the Brand Brain confirmation, open the connection list and ask of each: still needed by the current remit, still the narrowest scope, still a dedicated account, rotated on the schedule the tool requires. Disconnect what is no longer needed from the workspace, which revokes it at once and logs it. Reconnect with narrower scope where the tool has gained finer permissions.
Roles accumulate connections as remits grow; the review is where the accumulation is trimmed.
What does done look like?
Done is a connection list where every entry is a dedicated account with the narrowest permissions the tool allows, scoped to one property, confirmed by security with a name and date, and reviewed quarterly. Revoking any of them is one action in the workspace. An incident review can see exactly what the role could reach and when, and a leaked credential reaches only what that one account was allowed.
It is the least glamorous setup work and the most protective, and it is done once per tool.