Worker Bees act on your beehive’s data long after the person who set them up has moved on to other work, so creating one is treated as an administrative task. Permissions are granted to roles by a beehive administrator; see the permission catalogue.
Viewing and creating
| To | You need |
|---|---|
| See Worker Bees, each bee’s flight history and the actions available | workerbees:read:automations or workerbees:admin:automations |
| Create a Worker Bee (and edit, pause or delete one through the API) | workerbees:admin:automations |
Without the read permission, Worker Bees shows “You don’t have access to Worker Bees”. Without the admin permission, the New Worker Bee button is hidden.
Extra permissions for actions
You can only add an action whose permission you hold yourself. Actions you can’t use aren’t offered in the picker, and saving a bee that uses one is refused.
| Action | Also needs |
|---|---|
| Create task | tasks:write:tasks |
| Post to Slack, Post to Microsoft Teams | notifications:read:targets |
| Email a contact, Text a contact | relationships:read:contacts |
| Call a webhook, Emit an event | Read permission for the records behind every chosen trigger event (below) |
| Email a colleague | Nothing extra |
Read permissions for forwarding event data
Call a webhook and Emit an event pass the event’s details on, so you need to be allowed to read them.
| Trigger events | Read permission |
|---|---|
| Contact created, Contact updated, Organisation created | relationships:read:contacts |
| Touchpoint added | relationships:read:touchpoints |
| Payment created | relationships:read:fundraisingactivities |
| Task created, Task updated | tasks:read:tasks |
| Case created, Case closed | casemanagement:read:cases |
| Form submission received | engage:read:submissions |
| Gift Aid claim submitted, Gift Aid claim paid | taxes:read:giftaid |
| Membership renewal due | memberships:read:memberships |
The owner’s access is checked every time
Whoever creates a Worker Bee becomes its owner, and the bee runs with that person’s access. Each time it runs, ThirdSectorBee checks that the owner:
- still has access to the beehive; and
- still holds every permission the bee’s actions need.
If not, the flight fails with a reason such as “The automation owner no longer has permission to run this action.” Fields the owner can’t see are also left out of the event before the bee uses it. The Worker Bees list doesn’t show owners, so when someone leaves your organisation, ask them which bees they created and keep an eye on flight history afterwards. See Read a Worker Bee’s flight history for what to do.