Authorization

A practical example

Example: a lead-scoring tool only needs to read contact records and write a score field.

With field-level authorization, you can block it from reading revenue data; with account-wide credentials, it inherits full read access whether you intend it or not.

What to evaluate before investing

• Ask whether API scopes can be limited to specific objects and actions, not just broad read/write toggles.
• Check if field-level or record-level restrictions are supported, and whether they apply to integrations as well as users.
• Confirm you can audit which integration accessed which resource, with logs retained long enough to investigate incidents.

Limitations and tradeoffs

Fine-grained authorization adds configuration and testing overhead, and some vendors restrict it to higher tiers. Overly narrow scopes can also break workflows silently when a new step needs access nobody granted.