Integrations and action policy

Foreman connects to hundreds of tools across nine categories — CRM, calendars, docs, storage, projects, finance, developer tools, marketing, and support.

Connecting one takes a minute. What takes thought is the second half, which most people skip.

Read and write are not the same grant

A connected tool is readable by default. Writing — creating, updating, sending, deleting — is a separate, explicit grant per action.

This is the actual mechanism behind "nothing weighty ships without your nod". It is not a prompt asking agents to be careful; it is a wall. An agent without a write grant cannot write, regardless of what it decides to do.

Steps

1. Open Settings → Integrations and connect a tool.
2. Complete the provider's consent screen. Read what you are granting — this is your data.
3. Open the connected tool's action policy.
4. Grant write access only to the actions you want performed. Start narrow.
5. Ask for work that uses it, and watch what happens at the boundary.

You're done when an agent can do the thing you wanted and cannot do the thing you didn't.

Default access level

You can set a workspace-wide default for newly connected tools. Read-only is the sane default: it means a tool connected in a hurry cannot write until someone decides it should.

Gotchas

• A connected tool with no write grants will look broken to an agent. It will report that it cannot complete the action. That is the system working.
• Connections are per workspace. Connecting in one workspace does not connect it in another, and a workspace should never appear to have a connection it does not own.