---
title: Access and Authentication
description: Access and authentication for Workflow Automation
breadcrumbs: Docs > Actions > Workflow Automation > Access and Authentication
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Access and Authentication

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

A few tools control access and authentication for workflows and their components.

## Workflow identity{% #workflow-identity %}

Every run of a workflow uses a single Datadog identity, controlled by the workflow's Run as setting. That identity determines:

- Which [connections](https://docs.datadoghq.com/actions/connections.md) a run can resolve, including connections that use [private action runners](https://docs.datadoghq.com/actions/private_actions.md)
- Which Datadog resources a run can read and modify
- Which user a run's actions are attributed to, in [audit trails](https://docs.datadoghq.com/account_management/audit_trail.md#overview) and in the products those actions touch

A workflow can run as one of the following identities:

{% dl %}

{% dt %}
Owner
{% /dt %}

{% dd %}
The workflow runs as its owner, and any editor of the workflow can access the same resources as the owner. A new workflow runs as its owner by default.
{% /dd %}

{% dt %}
Initiator
{% /dt %}

{% dd %}
The workflow runs as the user who triggered the run, so each run is limited to the resources that user can access. The Initiator identity is only supported for [triggers](https://docs.datadoghq.com/actions/workflows/trigger.md) that have an end user.
{% /dd %}

{% dt %}
Service Account
{% /dt %}

{% dd %}
The workflow runs as a service account associated with the workflow. Use a service account to control the exact permissions a run has, with roles you choose for the workflow.
{% /dd %}

{% /dl %}

### Set the workflow identity{% #set-the-workflow-identity %}

Select an identity when you publish a workflow, or change it at any time:

1. In the workflow editor, click the cog (Settings) icon.
1. Click Edit permissions.
1. Under Run as, select Owner, Initiator, or Service Account.
1. Click Save.

The following restrictions apply:

- Only the owner of the workflow can select Owner or Initiator.
- To select Service Account, you need either the Datadog Admin Role or a custom role with the Service Account Write permission.

To see the identity a workflow uses, hover over the workflow name in the editor and read the Run as field.

### Run as the owner{% #run-as-the-owner %}

When a workflow runs as its owner, every run uses the owner's identity, whoever triggers it. A run can use the connections and Datadog resources the owner can access, even when the user who triggered it cannot access them.

The owner resolves the connections defined in the workflow actions. The owner needs the `connections_resolve` permission, plus Resolver access to each connection the workflow uses.

### Run as the initiator{% #run-as-the-initiator %}

When a workflow runs as the initiator, each run uses the identity of the user who triggered it. A run can only use the connections and Datadog resources that this user can access, and the actions the workflow takes are attributed to them. For example, if the workflow declares an incident, the incident is created by the user who triggered the workflow.

The initiator resolves the connections defined in the workflow actions. Each user who triggers the workflow needs the `connections_resolve` permission, plus Resolver access to each connection the workflow uses.

### Run as a service account{% #run-as-a-service-account %}

When a workflow runs as a service account, every run uses that account's identity, whoever triggers it. Because you choose which roles the service account has, you control the exact permissions a run has, independently of any user's permissions.

Attach an existing service account to the workflow, or create a service account when you set the identity. When you create one, you select its roles. You can assign any subset of the roles you have. With the User Access Manage permission, you can assign any role in your organization. For more information, see [Service accounts](https://docs.datadoghq.com/account_management/org_settings/service_accounts.md) or [Role based access control](https://docs.datadoghq.com/account_management/rbac.md).

The service account resolves the connections defined in the workflow actions. It needs a role with the `workflows_run` and `connections_resolve` permissions, plus Resolver access to each connection the workflow uses.

## Action credentials{% #action-credentials %}

Because workflow [actions](https://docs.datadoghq.com/actions/actions_catalog.md) connect with external software systems, you may need to authenticate your Datadog account to the corresponding integration. A workflow can run successfully only if every workflow action that requires authentication can verify the identity of your Datadog account.

Workflow actions can be authenticated in two ways:

- Credentials and permissions configured in the integration tile
- Connection credentials

For more information on configuring credentials, see [Connections](https://docs.datadoghq.com/actions/connections.md).

## Workflow permissions{% #workflow-permissions %}

Use [role-based access control (RBAC)](https://docs.datadoghq.com/account_management/rbac.md) to control access to your workflows and connections. To see the list of permissions that apply to workflows and connections, see [Datadog Role Permissions](https://docs.datadoghq.com/account_management/rbac/permissions.md#workflow-automation).

By default, the author of a workflow or connection is the only user who receives Editor access. The rest of the Datadog organization receives Viewer access to the workflow or connection.

### Restrict access on a specific connection{% #restrict-access-on-a-specific-connection %}

Set permissions on each connection to limit modifications or restrict their use. The granular permissions include Viewer, Resolver, and Editor. By default, only the author of the connection receives Editor access. The author can choose to grant access to additional users, roles, or teams.

{% dl %}

{% dt %}
Viewer
{% /dt %}

{% dd %}
Can view the connection
{% /dd %}

{% dt %}
Resolver
{% /dt %}

{% dd %}
Can resolve and view the connection
{% /dd %}

{% dt %}
Editor
{% /dt %}

{% dd %}
Can edit, resolve, and view the connection
{% /dd %}

{% /dl %}

Resolving a connection includes getting the connection object assigned to a step and retrieving the secret associated with it.

Follow the steps below to modify the permissions on a specific connection:

1. Navigate to the [Workflow Automation page](https://app.datadoghq.com/workflow).
1. Click Connections in the upper right. A list of connections appears.
1. Hover over the connection on which you would like to set granular permissions. Edit, Permissions, and Delete icons appear on the right.
1. Click the padlock (Permissions) icon.
1. Select Restrict Access.
1. Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
1. Next to the role name, select your desired permission from the dropdown menu.
1. If you would like to remove access from a role, click the trash can icon to the right of the role name.
1. Click Save.

### Restrict access on a specific workflow{% #restrict-access-on-a-specific-workflow %}

Set permissions on each workflow to restrict modifications or usage of the workflow. The granular permissions include Viewer, Runner, and Editor. By default, only the author of the workflow receives Editor access. The author can choose to grant access to additional users, roles, or teams.

{% dl %}

{% dt %}
Viewer
{% /dt %}

{% dd %}
Can view the workflow
{% /dd %}

{% dt %}
Runner
{% /dt %}

{% dd %}
Can run and view the workflow
{% /dd %}

{% dt %}
Editor
{% /dt %}

{% dd %}
Can edit, run, and view the workflow
{% /dd %}

{% /dl %}

You can restrict access on a specific workflow either from the workflow list page or from the workflow canvas while editing the workflow.

**Restricting permissions from the workflow list page**

1. Navigate to the [Workflow Automation page](https://app.datadoghq.com/workflow).
1. Hover over the workflow on which you would like to set granular permissions. Action icons, including Permissions, appear on the right.
1. Click the padlock (Permissions) icon.
1. Select Restrict Access.
1. Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
1. Next to the role name, select your desired permission from the dropdown menu.
1. If you would like to remove access from a role, click the trash can icon to the right of the role name.
1. Click Save.

**Restricting permissions from the workflow editor**

1. In the workflow editor, click the cog (Settings) icon.
1. Select Edit permissions from the dropdown.
1. Under Who has access, select Custom.
1. Select Restrict Access.
1. Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
1. Next to the role name, select your desired permission from the dropdown menu.
1. If you would like to remove access from a role, click the trash can icon to the right of the role name.
1. Click Done, then click Save.

## Further Reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Getting Started with Workflow Automation](https://docs.datadoghq.com/getting_started/workflow_automation.md)
- [Learn about integrations](https://docs.datadoghq.com/integrations.md)
- [See the list of workflow actions](https://docs.datadoghq.com/actions/actions_catalog.md)

 Do you have questions or feedback? Join the **#workflows** channel on the [Datadog Community Slack](https://chat.datadoghq.com/).