Before you begin
What you’ll need
- Entitlements or integrations module enabled
- Integration management permission
- An approved external destination
01
Understand an access decision
Access is calculated from the member, current membership term, configured rules, explicit grants or denials, and the destination resource.
- A current term may satisfy a plan rule for a publication, forum group, or resource.
- A grace-period policy may temporarily preserve access after a term ends.
- An explicit exception can add or deny access when authorized policy requires it.
- Archived, canceled, suspended, or otherwise ineligible relationships can deprovision connected access.
02
Explain and recalculate access
Use the access inspector before changing data. It shows the inputs and reason for the current decision.
- Select the member and protected resource.
- Review the current term, matching rule, exceptions, and effective result.
- Correct the underlying member, term, plan, or rule when the input is wrong.
- Recalculate the member's access and review the new explanation.
- Reconcile the external destination if the decision changed but delivery did not complete.
03
Operate a connected destination
Connectors consume organization-scoped access decisions. They do not become the source of truth for membership eligibility.
- Use signed, short-lived launches for member access to connected applications.
- Map organization resources to destination groups or resource identifiers explicitly.
- Keep credentials server-side and rotate them through the approved secret process.
- Use health checks and reconciliation to find drift between MembershipPortal and the destination.
04
Use APIs and outbound events safely
Organization APIs and webhooks are scoped, versioned integration surfaces. They are not substitutes for administrator sessions.
- Grant the smallest required scopes and keep credentials out of browser code, shared documents, and URLs.
- Verify webhook signatures and process each event idempotently.
- Treat retries as normal and preserve delivery identifiers for support.
- Replay failed work only after the destination problem is understood and the operation is safe to repeat.