# Tool Account

One identity inside a tool: a person, a shared login, a bot or a service. It is never the person.

A Tool Account is an identity a tool issued. The same person can hold several accounts, and a bot or a shared mailbox is an account too. Who stands behind an account is recorded in [Identity Binding](/systems/tooling/entity-identity-binding), never inferred from the display name or the login. CRM reads this table through its Tool Account mirror to route Cal.com bookings.

**Access Token is a clear-text credential column. Do not type into it, copy it, show it or build on it.** Read [Secrets and the Access Token column](/systems/tooling/secrets) before working on bot accounts.

## Rules and relationships

Link exactly one Tool (single-record picker). Link one Workspace when the tool scopes accounts to a tenant; the same person in two workspaces of one tool has two accounts. The Workspace picker accepts several records, and nothing checks that the workspace belongs to the same tool. Choose Kind = unresolved rather than guessing.

External Identifier is the tool's own id (for Slack the member id, for Cal.com the username). Login Alias is the sign-in name and does not prove identity. Source Lifecycle Label copies the tool's status word; deciding that access is revoked belongs to Access Grant.

Bound Person, Bound Membership and Bound Membership ID read through Identity Bindings. Automations use Bound Membership ID to find the same membership in another base, because record ids differ between bases. Their descriptions say they travel with the mirror, but the sync view used by CRM does not include them. Name is calculated from Display name, Tool and the workspace company (or External Identifier).

## Fields

| Field | Storage | Current configuration |
| --- | --- | --- |
| Name | Formula | Calculated; see rules below. |
| Display name | Text | Name the tool shows for the account |
| Workspace: Company | Lookup | Via Workspace → Company |
| Workspace (External Identifier) | Lookup | Via Workspace → External Identifier |
| External Identifier | Text | The tool's own account id |
| Login Alias | Text | Login used to sign in; not proof of identity |
| Kind | Single select | human, shared, bot, service, unresolved |
| Secret Ref | Text | Pointer to the vault entry; never the token |
| Source Lifecycle Label | Text | The tool's raw status word; evidence, not a decision |
| Identity Bindings | Linked records | [Identity Binding](/systems/tooling/entity-identity-binding); Multiple-record picker |
| Tool | Linked records | [Tool](/systems/tooling/entity-tool); Single-record picker |
| Workspace | Linked records | [Tool Workspace](/systems/tooling/entity-tool-workspace); Multiple-record picker |
| Principals | Linked records | [Access Principal](/systems/tooling/entity-access-principal); Multiple-record picker |
| Seat Allocations | Linked records | [Seat Allocation](/systems/tooling/entity-seat-allocation); Multiple-record picker |
| Access Token | Text | Clear-text bearer token for bot accounts. Do not use; see [Secrets](/systems/tooling/secrets) |
| Created by | Created by | Airtable user who created the row |
| Created at | Created time | When the row was created |
| Bound Person | Lookup | Via Identity Bindings → Person |
| Bound Membership | Lookup | Via Identity Bindings → Member |
| Bound Membership ID | Lookup | Via Identity Bindings → Member: Membership ID |
| Tags | Linked records | [Tags (mirror)](/systems/tooling/entity-tags); Multiple-record picker |

## Calculated rules

The expressions below use field names for readability. They label rows; they do not validate them.

### Name

```text
CONCATENATE(
  {Display name},
  IF({Tool}, " - " & {Tool}, ""),
  IF({Workspace: Company},
    " - " & {Workspace: Company},
    IF({External Identifier}, " - " & {External Identifier}, "")
  )
)
```

## Example

Display name = ana.costa; Tool = Slack; Workspace = Example Studio - Slack - T01ABCD2EFG; External Identifier = U04AB12CD; Kind = human; Access Token blank. Name reads `ana.costa - Slack - Example Studio`. A binding to Ana Costa fills Bound Person.

## Next steps

[Register a tool account](/systems/tooling/register-accounts) · [Secrets](/systems/tooling/secrets) · [CRM use](/systems/crm/entity-tool-account)