Maintain Tooling and Access

The Systems Central record for Tooling and Access names no maintainer. Agree an owner before changing synced views or bot accounts. Core maintainers correct shared people, organizations and memberships; CRM maintainers own Lead Source routing.

Routine review

• Tool Account → By Kynd: resolve accounts left as unresolved.
• Tool Account → By Person: the group with no Identity Bindings lists accounts nobody is bound to. A human account in that group needs a binding.
• Identity Binding → Grid view: look for an account with two bindings without Valid Through, and for bindings of people who left.
• Tool Account → Cal.com accounts: after any change, confirm the matching CRM Lead Source rule still points to the right account.
• When a tool reports an account as deactivated, update Source Lifecycle Label and close its binding.

Change safely

• bds:Tool, Tool Workspace Grid view and ops:ToolAccount Sync feed other bases. A column added there appears in a consumer; never add a credential or personal column.
• n8n reads fields by ID. Renaming a field keeps those reads working but may break name-based lookups and consumer formulas; deleting or retyping it breaks them.
• Keep External Identifier stable. Automations match on it, and the Slack cache rejects a workspace with two bot accounts.
• Each consumer base has a limited number of synced tables. Check its count before proposing a new mirror.

Retire access

Close bindings with Valid Through, set Revoked At on grants and Tool Access Status = Revoked on seats. Do not delete an account that CRM Lead Source, a Communication record or a past binding refers to. When a bot is removed from a workspace, take the row out of the Kind = bot set; the cache then invalidates that workspace instead of keeping a stale token.

Report an issue

Record defects in Systems Central as Feedback linked to the Tooling and Access system, or ask the maintainer for a Work Item. Name the table, view and row, and describe what you did, what you expected and what happened. Never paste a credential, even a revoked one.