An invoice automation has run every morning for a year. Then it stops. The cause is not a bug: the employee whose login it used left the company, and their account was closed as part of offboarding, exactly as it should have been.

Automations need access to other systems, and access expires, gets revoked, or changes owner. Treat that access as something to manage, not a detail set up once during the pilot.

Give each automation its own identity

Avoid running automations under a person's account. Where the system allows it, create a dedicated service account or integration with a clear name, such as "invoice-sync," and an owner on the team.

This has three benefits. The automation survives staff changes. Its actions are clearly labelled in audit logs. And its access can be limited to what it needs, as described in our guide to giving an AI workflow only the tools it needs.

Keep an access register

For each automation, record in one place:

  • Which systems it connects to, and under which account or integration.
  • What permissions it has in each.
  • Where the credential is stored, such as a password manager or secrets store. Never in a spreadsheet, chat message, or the automation's code.
  • When the access expires, if it does.
  • Who owns renewal, with a backup.

The register should describe the credential, not contain it.

Put renewal dates on a calendar

Many tokens and app connections expire after a fixed period, and some must be reauthorised by a person. Add a reminder two weeks before each expiry date, assigned to the owner. Renewing on a calm Tuesday is much easier than discovering the failure when a customer asks why an order is missing.

Make access failures obvious

When a connection is refused, the automation should stop and report clearly, for example "Accounting system rejected the login for invoice-sync." It should not keep retrying until the account is locked, or skip records silently. Send that message to the owner as an alert they can act on. Our automation alerts guide explains how.

Include automations in staff changes

Add one question to your offboarding and role-change checklists: does this person own, approve, or reauthorise any automation? If so, transfer that responsibility before their access ends.

Review access twice a year

Check each entry in the register. Is the automation still used? Does it still need every permission? Is the owner still the right person? Remove access that is no longer needed.

To set up an access register for your existing automations, email Storm Nova Labs.