Architecture and ownership
What Tooling owns, what it copies from Core, and which bases and workflows read it.
Tooling and Access owns tools, workspaces, accounts, identity bindings, plans, seats, principals, resources and grants. Core owns people, organizations, memberships, teams, departments and tags. CRM owns how a Cal.com account is routed to a seller; Tooling only provides the account.
Mirrors coming in
| Local table | Core source | Used here for |
|---|---|---|
| Person (mirror) | People | The person behind a binding, a workspace controller or owner, a plan payer |
| Organization (mirror) | Organizations | The Company behind a Tool Workspace |
| Membership (mirror) | Membership | The Member a binding serves; source of Bound Membership ID |
| Department (mirror) | Department | No native link yet |
| Grid view | Team | No native link yet; misnamed table |
| Tags (mirror) | Tags | Optional classification on every table |
Records going out
| Source table | Consumer base | Consumer table | Consumer use |
|---|---|---|---|
| Tool | Systems Central | Tool (mirror) | The tool a system runs on |
| Tool | Communication | Tool (mirror) | The tool a Channel uses |
| Tool Workspace | Communication | Tool Workspace (mirror) | The workspace a Channel lives in |
| Tool Account | CRM | Tool Account | Cal.com routing through Automation: Lead Source |
Airtable does not expose sync configuration through its API. The source views were inferred from matching field sets: bds:Tool, Tool Workspace Grid view and ops:ToolAccount Sync. The last one includes Access Token, and the CRM copy has an Access Token column; see Secrets. A Tool Account mirror in Communication and a Channel → Tool Account link are decided but not built (Work Item “Mirror Tool Account into Communication and link it from Channel”).
Follow the data
- Slack recipient: a KPIs & OKRs membership name → Person (mirror) → open Identity Binding → human Tool Account → workspace id → the token cache’s bot for that workspace.
- Cal.com seller: Tool Account → CRM Tool Account → Lead Source rule → accountable company and membership.
- Mailbox (workflow inactive): Gmail mailbox → Tool Account by Login Alias → Bound Membership ID → the CRM membership.
These readers use the Airtable API, not syncs. Automations lists them.
Resolve conflicts at the source
Correct people, organizations and memberships in Core. Correct account ids, logins, kinds and bindings here; consumer copies are read-only. Correct seller routing in CRM Lead Source, not by renaming accounts. Identity comes from bindings, never from matching e-mail strings.
Distinguish access from records
A seat is an entitlement, an unverified binding authorizes nothing and a tag grants nothing. Only Access Grant records a permission, and it was empty on 2026-10-28. Nobody has audited who can open this base or its consumers; field values here do not describe Airtable sharing.