Permissions
Recommended permission model for Real Bots.
Structure
Create one permission set per capability, then combine them with permission set groups.
| Permission set | Grants |
|---|---|
| Real Bots Administrator | Configuration objects, custom metadata, admin actions |
| Meeting Automation User | Review dashboard, Meeting Log read, task creation |
| Relationship Intelligence User | RI configuration object, Apex services, External Credential Principal Access for EIE_RI_Principal |
| Bot Integration Integration User | API access for the connected voice or chat platform only |
Relationship Intelligence permission set
Required access:
| Area | Permission |
|---|---|
| Relationship Intelligence Configuration | Read/Edit |
ribot__Signing_Certificate_KID__c | Read/Edit for administrators |
RIInboundAuth | Apex Class Access |
RelationshipIntelligenceService | Apex Class Access |
EIE_RI_Principal | External Credential Principal Access |
The principal must first exist under the EIE Relationship Intelligence Auth External Credential before it can appear in the permission set. See Named & External Credentials.
Assign the permission set to each user who runs:
- Verify Google Connection
- Relationship discovery
- Relationship Intelligence administration
- Other package actions that invoke the EIE Named Credential
A Salesforce System Administrator profile does not grant External Credential Principal Access. Missing principal access — or a missing permission-set assignment — is the most common cause of an authentication failure for a single user while other users succeed.
Field-level security
Restrict edit access on the signing certificate KID to administrators. Changing it breaks authentication until it is corrected.
Was this helpful?
Last updated 1 month ago