Capabilities & permissions

Out of the box the worker can do nothing. Every ability is a switch you turn on for a specific routine and a specific target.

Overview

What this covers

What a capability is, how granting and revoking works, how to scope one to a single routine, and how to check afterwards what was actually available.

How it works

A capability is a named ability bound to a target: read this folder, write to this register, send from this mailbox. Three rules follow from that:

Off means it does not exist. If a capability is not granted, the worker has no path to it — there is nothing to talk it into.
Scope is per routine. A capability granted to the Friday report is not available to another routine.
Write and send are separate. Reading a source never implies the right to change or send from it.

What was available during a run is recorded in the audit trail, so a review question has a factual answer.

Step by step

Open the routine you are setting up.
Add a capability and choose the exact target — the narrowest folder, mailbox or table that works.
Choose read only, unless the routine genuinely has to write.
Save and run the routine once.
If it fails for lack of access, add the one capability it named — not a broader one.
Check the audit trail to confirm what it used.
Revoke anything the routine turned out not to need.

Common problems

The grant is too broad. Whole-drive or whole-mailbox access is easy and hard to review later. Narrow it to the folder the routine names.
The routine fails mid-run. It reached a source it was never granted. Add that one target and re-run.
Access works for you but not for the worker. The Windows account running Harness needs the underlying permission too — a capability cannot grant what the OS denies.
Nobody remembers why a grant exists. Revoke it and re-run. If the routine still finishes, it was not needed.

What still stops for a person

Capabilities decide what is possible. Approvals decide what happens without you.

Approvals & audit

All documentation