Separate access from permission to act
An account's provider permissions determine what the credential can reach. Spinrun's workspace and tool rules determine who can use that connection and how its actions run. Review both layers when adding a sensitive account.
Prefer a narrow scope
Give a task the smallest useful set of tools and accounts. A reporting workflow usually needs reads before it needs writes. Keep a human review point for messages, publishing, record changes, and other consequential actions.
Change standing rules carefully
Use administrator settings for persistent permission changes. A chat instruction is not a role change. Recheck the rules when a workflow changes purpose or begins using an additional account.
Check the destination
The same tool can act on different records and accounts. Read the proposed destination before approving it. If the scope is unclear, reject the action and ask for a narrower proposal.
Open the relevant screen
Use Integration permissions in the active workspace. Sign in if needed. Check the workspace name before changing shared settings, connections, or billing.
If a control is unavailable, ask the workspace administrator or contact support. Include the screen, the action you tried, and the approximate time. Keep credentials and private customer material out of the request.