Licensed to be used in conjunction with basebox, only.
// admin
Connector permissions
Overview
Who may use a connector – and how that combines with enabling per app and personal credentials. basebox decides the availability of a connector across three levels, all of which must apply. A direct assignment "group X may use connector Y" does not currently exist; it is on the roadmap. This page shows how to achieve the same effect today.
What it is for
Not every connector is meant for every person: perhaps only a pilot team should use web search, only support the ticket system, everyone the mailbox. You control this by combining the three levels deliberately.
The three levels
| Level | Who sets it | Effect |
|---|---|---|
| 1. Organisation | Administrator, switch under Administration → Connectors | Is the connector usable in this organisation at all? |
| 2. App | Administrator or app creator with WRITE, in the app settings | Which connectors may this app use? A connector enabled in one app does not spill over into other apps |
| 3. User | Each person themselves | Has the person – where necessary – stored their own credentials? Without them, the connector's tools are not offered to the assistant in their chat |
A tool is available in a conversation only if all three apply: organisation on, app enables, user has activated. Technically, basebox forms the intersection of app enablement and user activation – see Authorization flow.
Where to find the settings
- Level 1: Administration → Connectors
- Level 2: "All apps" → Edit app → the app's connector settings
- Level 3: users in the chat via the "+" icon
Step by step: restricting a connector to a group
Because there is no group assignment per connector, use app sharing with groups as the lever:
- Enable the connector organisation-wide (level 1).
- Create an app in which exactly this connector is enabled (level 2). For web search: an app whose only connector is web search – that is also the safest configuration.
- Share this app via App sharing only with the desired group.
- Leave the connector off in all other apps.
Result: only members of the group have an app in which the connector is available. Whoever joins the group later gets access automatically.
Controlling read and write separately
Tools that change things in the connected system (create, update, delete) are disabled by default per app. An administrator must enable them explicitly. That way you can distribute an app with read access widely and a second app with write permissions only to a small team.
What the permissions do not control
What a person may see in the connected system is decided by that system – based on their own credentials. basebox adds no permissions and takes none away. A user with read access to project A in your ticket system sees only project A through basebox, whatever is enabled in basebox. See Connector authentication.
Notes
Note
- Roadmap: tool visibility per group and an optional human-in-the-loop approval are announced. Until then, app sharing with groups is the way. See Introduction to web search security.
- Disabling takes effect immediately – on each of the three levels.
- A user who does not see a connector under "+" is either not in an app that enables it, or the connector is off organisation-wide, or they have not stored their credentials. Check in that order.
- Changes to connectors and app sharing appear in the Audit log.
Frequently asked questions
Can I assign a connector directly to a group? Not currently. Use an app with the connector and share the app with the group.
Can I block a connector for individual users? Only indirectly – by the person not being in any app that enables the connector. In the source system you can additionally revoke their token.
Does app enablement also apply to web search? Yes. Web search is a connector and is enabled per app; users then switch it on per chat.
What happens if I switch off a connector organisation-wide that is enabled in apps? It is no longer available in any app. The app setting is retained and applies again when you switch the connector back on.
Need help? Contact support