Salesforce Integration Account
ATC-MID-0003901 · Salesforce
66
high risk
Ownership
Why it exists, and who answers for it
- Purpose
- Reads and writes CRM records on behalf of revenue and support automation.
- Business owner
- Rowan Adeyemi · Revenue Operations
- Technical owner
- Priya Raman · Support Engineering
- Type
- Integration identity — An ERP or SaaS integration account.
- Environment
- production
- Last authenticated
- 9 minutes ago
The chain
From a person to a resource
Every link is a place a question stops being answerable if nobody recorded it.
- Human ownerPriya Raman · Support Engineering
- AI agentSales Outreach Agent
- AI agentCustomer Support Automation
- Machine identitySalesforce Integration Account
- CredentialClient secret
- ResourcesSalesforce · Contacts, Salesforce · Reports, Salesforce · Bulk export
Risk
Why the score is 66
- +20
Credential
One secret shared by every consumer, so misuse cannot be attributed
- +16
Data
Customer PII across the CRM
- +12
Privilege
Holds bulk export rights used once in 90 days
- +10
Behaviour
Authentication volume rose sharply before the containment on 19 September
- +8
Compliance
Secret expires in 12 days with no rotation scheduled
- 66Total
Credentials
What it authenticates with
- Client secretlong-livedBearer secret
Salesforce API · read, write, export
- Last rotated
- 168 days ago
- Last used
- 9 minutes ago
- Expires
- in 12 days
Effective access
What it can do, against what it has done
Effective permissions, not assigned roles — a role, a group and a resource policy combine into reach that no single screen in the source system shows. 17 of 34 granted actions were not used in the last 90 days.
- Salesforce · ContactsWrite
held via Direct role
22 actions granted, 14 used. 8 could be removed on the evidence.
- Salesforce · ReportsRead
held via Group membership
8 actions granted, 2 used. 6 could be removed on the evidence.
- Salesforce · Bulk exportDelete
held via Resource policy
4 actions granted, 1 used. 3 could be removed on the evidence.
Blast radius
What a compromise of this credential reaches
2 agents stop working the moment this identity is quarantined — which is exactly what an operator needs to know before doing it.