Share workflows and credentials with view and run roles

Until now, a workflow and every credential behind it belonged to the one member who built it. You can now share both the way you share a document: pick members or give the whole workspace access, then choose what they can do. The person who connected Salesforce can hand a workflow to the team, and the team runs it without their own admin login. Read the announcement.

How it works

• Workflow roles. Viewers can open a workflow and its full run history; Runners can also launch it. Editing and managing access stay with the owner.
• Credential sharing. A shared credential can be selected in the recipient's own workflows, but the key or token stays encrypted and is only injected into the sandbox at run time, so nobody it's shared with can read it.
• Scoped to the workflow. A runner doesn't need a separate credential share; the credentials a shared workflow uses resolve for that workflow's runs only.
• Enforced on the server. Every action that changes a workflow or its runs checks access on the server, not just in the interface.

Also shipped

• Make a copy of any workflow you can read; credentials you don't own are removed from the copy.
• Email notifications when something is shared with you, and runs record who started them.