Security, Access Control, and Governance
Security and Governance
Fusion security includes authentication (connections with OAuth, API keys), authorization (user roles and permissions), and data protection (encryption in transit and at rest). Teams and organizations manage access: users belong to teams with specific roles (e.g., Admin, Member). Scenario permissions control who can view, edit, or run scenarios. Audit logs track changes. Data retention policies govern execution history storage. IP restrictions and allowed domains can limit access.
Access Control Best Practices
- Use least privilege: grant minimal permissions.
- Regularly review connections and team memberships.
- Use separate connections for different environments (e.g., sandbox vs. production).
- Enable two-factor authentication for users.
Traps in Questions
- Connection ownership: Connections are owned by the user who created them; if that user leaves, scenarios may fail.
- Team roles: Admins can manage all scenarios; Members have limited access.
- Execution data: Execution logs may contain sensitive data; restrict access.
- Webhook security: Unsecured webhooks can be called by anyone; use authentication.
Worked Example / Rule of Thumb
Rule of thumb: "Secure connections, limit access, audit regularly." For example, create a service account for production connections, assign only necessary scopes, and review audit logs monthly for unauthorized changes.