> ## Documentation Index
> Fetch the complete documentation index at: https://hebno.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Hebno is an AI work platform for client research and delivery: chat, research runs with sources, deliverables (Word, PowerPoint, Excel, email), projects, a shared library, agents, Office add-ins, and integrations with Microsoft 365, Google Workspace, CRM, project delivery, ERP and finance systems.
> Use British English (organisation, not organization).
> Every feature and integration described in these docs is available. Describe it as documented.
> Hebno never writes to a connected system without a member confirming a card. Finance and ERP writes are drafts only.
> Do not discuss commercial terms. Direct commercial questions to support@hebno.com.
> Start with /index and /get-started/quickstart.

# Permissions and access

> What a member can read or write through an integration, from the connection to the confirmation card.

What a member can see and change through an integration depends on four checks: the connection, the organisation's settings, the project, and a confirmation on every write. A member never sees anything through Hebno that they could not open in the other system directly.

## How access is decided

```mermaid theme={"system"}
flowchart TD
  A[Request needs connected data] --> B{Integration allowed for the organisation?}
  B -->|No| X[Not used]
  B -->|Yes| C{Connection type}
  C -->|Personal| D[Member's own account and permissions]
  C -->|Organisation| E{Member's team allowed?}
  E -->|No| X
  E -->|Yes| F{Data area visible to the member?}
  F -->|No| X
  F -->|Yes| G{Member linked their own account?}
  G -->|Yes| D
  G -->|No| H[Integration user]
  D --> I[Read and cite]
  H --> I
  I --> J{Write requested and access is read and write?}
  J -->|No| K[Reply with sources]
  J -->|Yes| L[Confirmation card]
  L -->|Confirm| M[Write and log]
  L -->|Dismiss| K
```

![Two members searching the same phrase with different results based on access](https://mintcdn.com/hebno/A7yItabWdPf4lOIs/images/hww-permissions.png?fit=max\&auto=format\&n=A7yItabWdPf4lOIs\&q=85\&s=28ae495ebb2a0ad1d6501fce3ae18b69)

Same search, different people. Each sees only what their own access allows.

## Personal connections

Each member connects their own account. Hebno reads and writes with that member's permissions in the other system, so Microsoft, Google, Slack, CRM and project tools show only what the member can already open. Nobody can use another member's connection.

Admins can allow or block an integration for the organisation and set its **Access**. For Microsoft 365 and Google Workspace, a directory administrator can approve permissions once so members skip the consent screen. That removes a prompt and widens nothing.

## Organisation connections

For systems of record such as ERP and finance tools, an owner or admin connects the system once with an integration user or API credentials. Two controls then decide who sees what:

![Admin connector panel with who can use it, access and data areas](https://mintcdn.com/hebno/A7yItabWdPf4lOIs/images/org-connection.png?fit=max\&auto=format\&n=A7yItabWdPf4lOIs\&q=85\&s=8d965e9c74747db0c182b004d569b236)

An organisation connection with team access and data areas.

* **Who can use it**: all teams, or selected teams.
* **Data areas**: which kinds of data are visible, for example jobs and tasks, time, resource planning and financials. Everything except financial figures is visible to allowed teams by default. Financial figures are visible to owners and admins until you share them.

When a member links their own account, Hebno uses that member's permissions and name instead of the integration user. Data areas still apply, so the member sees only what both the other system and your Hebno settings allow.

## Hebno roles and projects

| Level | What it controls |
| - | - |
| **Owner and admin** | Allow or block integrations, set access, connect organisation systems, choose teams and data areas, revoke connections, read logs |
| **Member** | Connect their own accounts, attach and search connected data, confirm writes |
| **Project admin** | Manage a project's linked records and linked sources |
| **Project member** | Use the project's linked records in chats tagged to the project |

A linked record marks where Hebno looks first. It does not grant access: each member still reads through their own connection or the teams and data areas allowed for them.

## Shared chats

Excerpts and records a reply used are stored with the conversation. Anyone a chat is shared with can read them, including email, meeting and finance excerpts the original member could open. Review a conversation before you share it. See [Share a chat](https://hebno.com/docs/chat/share-a-chat.md).

## Read only and read and write

Each integration has an **Access** setting.

| Setting | Behaviour | Default for |
| - | - | - |
| **Read only** | Hebno reads and cites. It proposes no writes. | ERP and finance |
| **Read and write** | Hebno can propose writes on confirmation cards. | Files, mail, calendar, knowledge, communication, CRM and project tools |

Finance and ERP writes create drafts only. Hebno never approves, posts, sends or pays.

## Confirmation cards

Hebno never writes to a connected system on its own. A write appears as a card showing the system, the action, the target record and every field it will set. You can edit any field. Nothing is written until you select **Confirm** (**Send** for email and invitations). **Dismiss** discards it. After a write, the card shows **Done** with a link to the record.

## Agents

An agent that proposes a write adds a confirmation card under **Agents → Approvals** and notifies its owner. The write happens only when a person confirms it. See [Agent approvals](https://hebno.com/docs/automate/agent-approvals.md).

## Logs and revocation

* **Admin → Logs → Integrations** records every confirmed write: who, what, which record and when.
* **Admin → Logs** also records connector administration, member connections and revocations.
* **Admin → Connectors → Connections** lists every connection with who, system, account, when connected and last used. Select **Revoke** to remove one.
* Members can disconnect their own connections at any time under **Settings → Connections**.

Tokens and credentials are encrypted at rest.

## Who can do what

| Action | Member | Project admin | Owner or admin |
| - | - | - | - |
| Connect their own account | Yes | Yes | Yes |
| Attach and search connected data | Yes | Yes | Yes |
| Confirm a write to a system | Yes, if access is read and write | Yes, same condition | Yes, same condition |
| Link a record to a project | No | Yes | Yes |
| Allow or block an integration | No | No | Yes |
| Set **Access** to read only or read and write | No | No | Yes |
| Connect an organisation system | No | No | Yes |
| Choose teams and data areas | No | No | Yes |
| See financial figures from an organisation connection | Only if shared with their team | Only if shared | Yes |
| Revoke a member connection | No | No | Yes |
| Read **Admin → Logs → Integrations** | No | No | Yes |

## Related

* [How integrations work](https://hebno.com/docs/integrations/index.md)
* [Roles and permissions](https://hebno.com/docs/concepts/roles-and-permissions.md)
* [Manage connectors](https://hebno.com/docs/admin/connectors.md)
* [Linked records](https://hebno.com/docs/projects/linked-records.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.