# Workflows declare databases and browsers as credential slots

> Workspace databases and saved browsers are chosen in credential slots like integrations, and a workflow run can reach only the resources it declared.

Aug 24, 2026. Topics: Workflows, Security, Integrations. https://www.generalinput.com/changelog/2026-08-24-databases-browsers-credential-slots

Workflows, apps, and templates declare the integrations they need as credential slots. Databases and browsers now go through the same slots: the picker lists your databases and browsers beside your integration credentials, and publishing refuses a slot nobody filled. The result is that a workflow states up front every resource it touches, and the platform holds it to that list.

### How it works

- **One decision point.** A single service decides whether a slot is backed by an integration credential or a platform resource, so pickers, validation, publishing, duplication, templates, and app handlers all treat both the same way.
- **Keys scoped to the declaration.** The short-lived key a workflow run receives carries the resources it declared. A call to a database outside that set is refused with a message naming the slot to add, so an agent can correct itself.
- **Browsers only where declared.** A saved workflow can open only the browsers it declared, so every browser session traces back to a browser someone can point at.
- **Built-in services read as ready.** Services we host, like internet search, show as usable without asking you to connect them.
- **Migrated first.** Existing workflows that used a database or browser were updated to declare it before strict scoping turned on.