> For the complete documentation index, see [llms.txt](https://developer.kizen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.kizen.com/docs/concepts/smartconnectors/smartconnector-permissions.md).

# SmartConnector Permissions

{% hint style="success" %}
**Audience:** Administrators, Solution Architects, Developers

**Purpose:** Understand how permissions govern access to <code class="expression">space.vars.smartconnectors</code> at both the configuration level and at runtime.
{% endhint %}

## Overview

<code class="expression">space.vars.smartconnector</code> permissions work at multiple levels:&#x20;

* <code class="expression">space.vars.smartconnector</code>-level permissions control who can configure and operate a specific <code class="expression">space.vars.smartconnector</code>.&#x20;
* Bulk run permissions control whether a user can trigger <code class="expression">space.vars.smartconnectors</code> against a specific <code class="expression">space.vars.object</code>.
* Runtime behavior governs how the <code class="expression">space.vars.smartconnector</code> itself reads and writes data when an execution runs.

Each of these layers is configured separately and operates independently. For more details about how permissioning works in Kizen, see [Permissions](/docs/settings-and-administration/permissions.md).&#x20;

***

## SmartConnector-Level Permissions

Access controls govern who can view, edit, activate, and run a <code class="expression">space.vars.smartconnector</code>. These controls are configurable per <code class="expression">space.vars.smartconnector</code>, which means different <code class="expression">space.vars.smartconnectors</code> can have different access rules even within the same business.

<code class="expression">space.vars.smartconnector</code> permissions are configured using two sliders, each representing a separate permission area:

* **All SmartConnectors**: sets the baseline permission level that applies across all <code class="expression">space.vars.smartconnectors</code> in the business.
* **My SmartConnectors**: sets the permission level for <code class="expression">space.vars.smartconnectors</code> owned by the user. This value must be at least View/Use and at least the maximum permission set on All <code class="expression">space.vars.smartconnectors</code>.

Each slider moves across four permission levels for **All SmartConnectors**: **None**, **View/Use**, **Create/Edi**t, and **Delete/All**.

For **My SmartConnectors**, there are three permission levels: **View/Use**, **Create/Edi**t, and **Delete/All**.

<div data-with-frame="true"><figure><img src="/files/3Y1B16cJCxlYPuu2QZmq" alt="" width="563"><figcaption></figcaption></figure></div>

<code class="expression">space.vars.smartconnector</code>-level permissions control access to the <code class="expression">space.vars.smartconnector</code> itself. They do not govern what data the <code class="expression">space.vars.smartconnector</code> can read or write when it runs.

***

## Bulk Run Permissions

To control whether a permission group can run a <code class="expression">space.vars.smartconnector</code> against <code class="expression">space.vars.contacts</code> or an <code class="expression">space.vars.object</code> in bulk, locate the **Start SmartConnector** toggle under Perform Bulk Actions (Set All) in the Permission Group settings for that <code class="expression">space.vars.object</code>. This setting uses two permissions levels: **None** and **Delete/All**. It is configured per <code class="expression">space.vars.object</code> type, and only applies to Bulk Action <code class="expression">space.vars.smartconnectors</code>.&#x20;

<div data-with-frame="true"><figure><img src="/files/2kQGWUoTRbsiIIBekQlA" alt="" width="563"><figcaption></figcaption></figure></div>

***

## Runtime Behavior

<code class="expression">space.vars.smartconnectors</code> do not run in the context of a specific user. <code class="expression">space.vars.entities</code> created or updated by a <code class="expression">space.vars.smartconnector</code> are not attributed to a running user for permission-filtering purposes. The load step writes data based on the <code class="expression">space.vars.smartconnector</code>'s configuration, not based on who initiated the run.

A <code class="expression">space.vars.smartconnector</code>'s access to Kizen data is controlled by the Reference Data made available to that <code class="expression">space.vars.smartconnector</code>. Any field from any <code class="expression">space.vars.object</code> can be added as Reference Data, so administrators should be intentional about what data is surfaced to a <code class="expression">space.vars.smartconnector</code> at configuration time.

Within a <code class="expression">space.vars.smartconnector</code> execution, the SQL Execution step cannot write data back to Kizen. Only the Load Step can write data to Kizen, and when it does, it can write to any field on any entity regardless of the initiating user's individual field permissions.

{% hint style="info" %}
**Note**: Because <code class="expression">space.vars.smartconnector</code> executions do not run as a specific user, a <code class="expression">space.vars.smartconnector</code> can write to fields and <code class="expression">space.vars.objects</code> that the initiating user may not have permission to access directly in the UI. Account for this when granting run access to <code class="expression">space.vars.smartconnectors</code> that write to sensitive data.
{% endhint %}

***

## What's Next

With permissions understood, the next consideration is how <code class="expression">space.vars.smartconnectors</code> can be packaged and moved between environments. [SmartConnector Export, Import, and Duplication](/docs/concepts/smartconnectors/smartconnector-export-import-and-duplication.md) covers how <code class="expression">space.vars.smartconnectors</code> can be exported as portable packages, imported into the same or a different business, and duplicated within a business for iterative development.

<details>

<summary>Related Topics</summary>

* [SmartConnector Load Steps](/docs/concepts/smartconnectors/smartconnector-load-steps.md)
* [SmartConnector Settings](/docs/concepts/smartconnectors/smartconnector-settings.md)
* [Running a SmartConnector](/docs/concepts/smartconnectors/running-a-smartconnector.md)
* [SmartConnector Diff Checking](/docs/concepts/smartconnectors/smartconnector-diff-checking.md)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.kizen.com/docs/concepts/smartconnectors/smartconnector-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.