[00:00:13]
Dan Fellars: Alright, welcome back to the BuiltOnAir Podcast.
[00:00:16]
Dan Fellars: We are in the third episode of our DevOps series where we’re looking at the admin side of running a business on Airtable.
[00:00:23]
Dan Fellars: Be sure to check out our previous episodes if you haven’t already.
[00:00:26]
Dan Fellars: So last time we renamed a field and watched what broke and how to fix it.
[00:00:30]
Dan Fellars: Today’s question is right before that.
[00:00:33]
Dan Fellars: Who controls your Airtable environment?
[00:00:36]
Dan Fellars: who can change the base, what do you integrate, what do your integrations run on, and who decides what as far as who can access everything.
[00:00:45]
Dan Fellars: So in most workspaces, the honest answer is almost anyone can change it.
[00:00:49]
Dan Fellars: The integrations run on somebody’s personal token and the controls that would fix both of those exist, but they’re switched off.
[00:00:57]
Dan Fellars: So let’s break it down into three questions again.
[00:01:00]
Dan Fellars: First, Who can change the base and its environment?
[00:01:04]
Dan Fellars: Second, which of the controls you already have are actually turned on.
[00:01:08]
Dan Fellars: And third, what do your integrations run on and what happens to all of it when somebody leaves.
[00:01:15]
Dan Fellars: So let’s start with giving people access.
[00:01:19]
Dan Fellars: I’m gonna be working in the same client onboarding base from the last episode.
[00:01:23]
Dan Fellars: So when I go to invite somebody to the space, I type in their email address, and then I pick what role you’re gonna have or this person’s gonna have.
[00:01:32]
Dan Fellars: By default, they get the creator role, but you can change it to other permissions.
[00:01:38]
Dan Fellars: The different roles are spelled out here.
[00:01:40]
Dan Fellars: A creator can fulfure the base, including automations and interfaces.
[00:01:45]
Dan Fellars: An editor is likely where most of your end users are gonna be.
[00:01:48]
Dan Fellars: They can perform edits and updates to any of the data, but can’t change the structure of your base or your automations or interfaces.
[00:01:57]
Dan Fellars: And then our commenter or read-only access are there for lower level access.
[00:02:02]
Dan Fellars: And also not shown here is owner level access for the base level, which there needs to be at least one owner for every base.
[00:02:12]
Dan Fellars: Here’s an important exercise you should do on a regular basis.
[00:02:15]
Dan Fellars: If you ever wonder why your Airtable bill is larger than you would hope, check out your list of users in your admin area and count how many have something other than read-only access to your environment.
[00:02:27]
Dan Fellars: Those are the people that you’re paying for, and it’s likely you’ll see people on that list that you didn’t realize.
[00:02:32]
Dan Fellars: And if you’re on a lower tier than than business, You need to look at every single base as people are counted twice for each base that they have uh edit access to in terms of billing.
[00:02:45]
Dan Fellars: So if but if you’re in business or higher, then that is spread across all the bases.
[00:02:49]
Dan Fellars: So that’s one of the benefits of the higher tiers.
[00:02:54]
Dan Fellars: Another exercise is to see if you can reduce access levels where possible.
[00:02:59]
Dan Fellars: So do all your creator level users need to be a creator?
[00:03:03]
Dan Fellars: Or could they be an editor level instead?
[00:03:06]
Dan Fellars: Or even can you move people from the editor access that only really need read-only access?
[00:03:12]
Dan Fellars: That will save you a lot in the long run, both in expenses as well as who can do what with your data and avoid any conflict.
[00:03:23]
Dan Fellars: Now this is where it starts to get really confusing.
[00:03:26]
Dan Fellars: When you start looking at interface only access, anybody who doesn’t have base level access to the base, they can be modified to just have certain levels of editor, comment, or read only access just to a single interface or one or more interface, and they wouldn’t be able to see the underlying base data.
[00:03:47]
Dan Fellars: So this is very powerful, but it can be confusing to keep track of who has access to what.
[00:03:53]
Dan Fellars: So you need to be aware of that.
[00:03:55]
Dan Fellars: Now let’s make this even more complex.
[00:03:58]
Dan Fellars: Within the base you can go even further.
[00:04:00]
Dan Fellars: You can go field by field.
[00:04:01]
Dan Fellars: So if you open up any fields permissions and the default is editor and up, so every editor can change it.
[00:04:09]
Dan Fellars: But you can raise that to a creator level and up, or nobody, or even specific users.
[00:04:15]
Dan Fellars: And specific users now include groups.
[00:04:17]
Dan Fellars: That’s a new feature they just added.
[00:04:19]
Dan Fellars: So in the admin panel under groups, you can name the people once, say account managers, and then the monthly fee field here is something only account managers can change.
[00:04:31]
Dan Fellars: without making any of them a creator on the base.
[00:04:35]
Dan Fellars: So as mentioned before in the admin panel, the users page is where you go to evaluate who has access to what and at what level.
[00:04:43]
Dan Fellars: If they’re an external user meaning they come from an outside domain.
[00:04:47]
Dan Fellars: And if they can what they can manage from here.
[00:04:52]
Dan Fellars: So also in the admin panel.
[00:04:55]
Dan Fellars: is where we can add some controls around access and security.
[00:04:59]
Dan Fellars: So on the business plan or higher, if you go to settings, then security and compliance, there’s a list of controls.
[00:05:06]
Dan Fellars: You can manage single sign-on, two-factor authentication, the length of web sessions, which is how long they can be logged in before they have to log in again.
[00:05:16]
Dan Fellars: And if you have the enterprise tier, it has even more controls available for a stricter security governance uh capabilities.
[00:05:26]
Dan Fellars: Then under the sharing admin, you can manage collaborator invites, who can invite, and whom can be invited.
[00:05:35]
Dan Fellars: Or the share link visibilities, so shared view links, form links, embedded views, published interface, they should all be configured correctly for your business needs from this environment.
[00:05:49]
Dan Fellars: Now let’s move on to the third question.
[00:05:52]
Dan Fellars: And this one is very easy to let fly under the radar, as it’s not very visible once you’ve created it.
[00:05:58]
Dan Fellars: All your integrations, your AI agents, your scripts, almost all of them run on personal access tokens or OAuth apps.
[00:06:07]
Dan Fellars: Here’s the token list, which is in the Builder Hub from your own account.
[00:06:12]
Dan Fellars: So look at the access column.
[00:06:14]
Dan Fellars: All work spaces and bases.
[00:06:16]
Dan Fellars: And so some of these were created a long time ago.
[00:06:21]
Dan Fellars: It’s easy to not be aware of these, and every one of them belongs to a single person, so every person has their own list and their own builder hub.
[00:06:29]
Dan Fellars: So when creating these or allowing access through OAuth, be sure to limit the access to the minimum bases and the scope required to do the job for that token.
[00:06:40]
Dan Fellars: Here’s what creating one looks like.
[00:06:41]
Dan Fellars: The warning at the top is worth calling out.
[00:06:43]
Dan Fellars: It says to only use this token for your own development.
[00:06:46]
Dan Fellars: Don’t share it with third party services.
[00:06:49]
Dan Fellars: That is good advice, but often not followed, myself included, sometimes for valid reasons.
[00:06:54]
Dan Fellars: But then again, be sure to just give access to the minimum scope and bases needed for this token.
[00:07:01]
Dan Fellars: However, if you need more granular access to control who can create personal access tokens or approve third-party integrations, the admin panel has the ability to lock those down to specific users as needed.
[00:07:16]
Dan Fellars: Something else that’s tied to an individual user is sync tables.
[00:07:21]
Dan Fellars: When you sync a view from one base to another, that sync belongs to whoever set it up.
[00:07:27]
Dan Fellars: So here’s the source view, uh sync activity, destination base, and sync created by, which is me.
[00:07:36]
Dan Fellars: And if you open the sync table settings and look for a way to hand it over, there isn’t one.
[00:07:41]
Dan Fellars: You can change the source or remove it.
[00:07:44]
Dan Fellars: So when the person who sets it up, that sync is deactivated.
[00:07:49]
Dan Fellars: The table stop reupdating and someone has to re-sync it up under their own user.
[00:07:54]
Dan Fellars: I’ve been burned by this.
[00:07:56]
Dan Fellars: It’s it’s uh frustrating when somebody gets deactivated from the account and you don’t know where it’s impacting.
[00:08:05]
Dan Fellars: Okay, so now everything’s working as expected.
[00:08:08]
Dan Fellars: Then somebody like we talked about leaves the company.
[00:08:11]
Dan Fellars: You realize that person has access to everything and has a lot of syncs and automation set up under their user.
[00:08:18]
Dan Fellars: Now what do you do?
[00:08:19]
Dan Fellars: In the admin panel, it’s um one menu.
[00:08:23]
Dan Fellars: You just go to their user and click remove access, but then think about what goes with them.
[00:08:28]
Dan Fellars: Their token stop um reaching your bases.
[00:08:32]
Dan Fellars: So if they have any scripts or external zaps or makes, those are gonna stop fail start failing.
[00:08:38]
Dan Fellars: Any automation steps connected with their Slack or Gmail account are gonna stop working.
[00:08:43]
Dan Fellars: Bases sitting in their own workspace leave with them.
[00:08:48]
Dan Fellars: So it can be a real pain to deal with somebody leaving your organization.
[00:08:52]
Dan Fellars: Being aware of where to look to find what they had access to is critical to manage that specific scenario.
[00:08:59]
Dan Fellars: And keep a checklist.
[00:09:01]
Dan Fellars: In fact, I’ve got a checklist here of things that you can take stock of when your user uh governance w as far as where your user and governance stands today.
[00:09:11]
Dan Fellars: So first review who has access to all your data across spaces and interfaces.
[00:09:17]
Dan Fellars: And at what level?
[00:09:19]
Dan Fellars: Check for any field specific permissions.
[00:09:22]
Dan Fellars: Then review your admin panel for what you can control in terms of who has access to what and when.
[00:09:29]
Dan Fellars: Then look at your API and your personal access tokens to review who is accessing it from outside of Airtable.
[00:09:37]
Dan Fellars: that will get you ahead of the game and get you ready for dealing with these transitions.
[00:09:42]
Dan Fellars: So next time we’re gonna talk about bases and how they are your key source of documentation, how to answer questions when it isn’t there or obvious.
[00:09:52]
Dan Fellars: So be sure to like, subscribe, and join our community.
[00:09:56]
Dan Fellars: And if you’ve ever dealt with any of these issues when somebody’s leaving, I’d love to hear your stories and how you dealt with it.
[00:10:02]
Dan Fellars: Until next time, we will see you on the BuiltOnAir Podcast.
[00:10:06]
Dan Fellars: Take care.