Managing companies and per-company credentials

CloudRadial AutomationAI lets you register the companies you manage as first-class records in your workspace, then point an integration's credentials at a specific company instead of using one shared set. This article explains what a company record is, how per-company credentials are resolved at run time, and how to scope a workflow or agent step to a company. It is for workspace users with the Admin role or higher.

• What a Company Record Is
• Adding a Company
• Naming Per-Company Secrets
• Setting a Secret Policy
• Scoping a Step to a Company
• Restricting an Extension to Companies
• Managing Companies in Bulk
• Runner Requirements

What a Company Record Is

A company is one of the downstream organizations you automate on behalf of. Each company record carries:

• A Company ID, the identifier your source system uses. It is fixed once the record exists and is what a workflow refers to at run time.
• A Company name, for display
• An optional secret suffix, which is what makes per-company credentials possible
• Any number of aliases, so several vendors' identifiers can resolve to the same company

Companies live in your workspace only. They are never shared between workspaces, and they are not carried in a workflow you export.

Adding a Company

Go to Companies and select Add company. Enter the Company ID, the display name, and a secret suffix if that company will have its own credentials. If you manage more than a handful of companies, import them from an installed extension instead of typing them in; see the article on importing companies from an integration.

The Companies grid filters per column on Company, Company ID, and Source, so you can find a record in a large registry without scrolling.

Naming Per-Company Secrets

Per-company credentials are ordinary secrets in your runner's Key Vault, named by appending the company's secret suffix to the base secret name:

<BaseSecretName>-<secretSuffix>

For example, if an extension reads Autotask-ApiKey and a company's secret suffix is 990001, that company's credential is the secret named Autotask-ApiKey-990001. The base secret stays in place and is still used by anything not scoped to a company. For how to add a secret to the vault, see the article on updating secrets in your runner's Key Vault.

The Companies page shows a coverage matrix of companies against secret names, so you can see at a glance which per-company credentials exist and which are still missing.

Setting a Secret Policy

A secret policy tells the runner what to do with a base secret name when a company is in scope. There are three:

Set a policy per secret name from the secret policy matrix on the Companies page. Choose Require company when a fallback to a shared credential would be wrong, for example where reaching the wrong company's tenant is worse than a failed run.

Scoping a Step to a Company

A step resolves per-company credentials only when a company is in scope for that step. In the Designer, Agent, script, and For Each nodes carry company-scope controls:

• Pin a company to run the step against one specific company
• Iterate companies to run the step once per company in your registry

Pinning names a specific company record, so it is meaningful only in the workspace that holds it. Iterating does not name a company and is portable between workspaces.

Restricting an Extension to Companies

An extension can be marked company-only, which means its tools will not run unless a company is in scope. Catalog extensions may ship with this set, and you can override it for your own workspace from Extensions. Use it to prevent a step from reaching a vendor with shared credentials when every call should be attributed to one company.

Managing Companies in Bulk

The Manage blade on the Companies page applies changes across the whole registry. From it you can set secret policies in bulk, and delete every company at once. Deleting is permanent, not an archive, so it asks you to type a confirmation first. Use delete-all when you want to re-import a registry from scratch.

Runner Requirements

Company-scoped credentials require a runner on version 1.7.0 or later. A runner below that version will not accept a company-scoped step: the step fails before it is claimed rather than running with the wrong credentials, and deploying a company-scoped workflow to an out-of-date runner is blocked. Check each runner's version on the Runners page and see the article on upgrading a runner to a new version.

If you are still having trouble, we're here to help! Submit a ticket for assistance, and don't forget to check our status page to ensure there are no outages in your area.