Automation is mostly the act of connecting systems that were never designed to talk to each other. Every connection is a door. Here’s what to check before you open one.
The fastest way to create a security problem is to connect two tools in a hurry. Each integration hands one system access to another, and most of them ask for far more than they need. Before you wire anything together, this is the checklist we run.
Access scopes: grant the least you can
Most integrations request broad access by default because it’s easier for the vendor, not because the workflow needs it. Push back. Grant read-only access where you can, scope tokens to the specific resources involved, and review what each connection can actually reach.
- Use read-only permissions unless the workflow genuinely needs to write.
- Scope tokens to specific projects, folders, or record types, not the whole account.
- Revisit permissions periodically and revoke anything unused.
Secrets and credentials
API keys and tokens are the keys to the building. Treat them that way. They should never sit in plain text, in code, or in a shared spreadsheet.
- Store credentials in a secrets manager or vault, not in the automation itself.
- Rotate keys on a schedule, and immediately if anyone with access leaves.
- Give each integration its own credential so you can revoke one without breaking the rest.
Logging and auditability
When something goes wrong, and eventually it will, you need to see what happened. Good logging is the difference between a five-minute fix and a five-day investigation.
- Log actions and outcomes: who or what did something, when, and whether it succeeded.
- Avoid logging sensitive payloads. Record that a record was processed, not its contents.
- Keep logs somewhere tamper-resistant and reviewable.
Data retention and residency
Just because you can store data doesn’t mean you should. Every piece of data you keep is a piece of data you have to protect.
- Set retention limits and delete what you no longer need.
- Know where data physically lives, especially for clients with regional requirements.
- Minimize copies. The safest data is the data you never duplicated.
Every integration is a door. The goal isn’t to avoid opening doors, it’s to know exactly which ones are open and what’s behind each one.
Where sensitive data is allowed to flow
Map the path your sensitive data takes before you automate anything that touches it. Personal, health, or financial data should only reach systems explicitly allowed to receive it. This matters most with AI: be deliberate about what leaves your boundary and enters a model, and confirm how that provider handles it.
The pre-launch checklist
Before any automation goes live, confirm:
- Every connection uses the minimum access it needs.
- No credentials live in code or plain text.
- Actions are logged, sensitive payloads are not.
- Retention limits are set and data residency is known.
- Sensitive data only flows to approved systems.
Security isn’t a phase you bolt on at the end. It’s a set of defaults you build in from the very first connection.