Integration access is the standing permission one system holds to read or write data in another — the HRIS feeding the payroll platform, the payroll platform feeding the benefits administrator, the time system feeding them all. It is how modern workforce operations function, and it is the least examined category of access in almost every organization.
Human accounts get onboarding, offboarding, and reviews. Integrations get configured once, by whoever ran the implementation, and then run silently for years — with credentials that never expire, scopes broader than needed, and no owner.
Why integrations concentrate risk
An integration credential has properties no security team would tolerate in a human account. It is long-lived, often never rotated since setup. It is broadly scoped, because requesting full access was easier during implementation than mapping the minimum. It authenticates without MFA, since no human is present to approve a prompt. It operates around the clock, so anomalous activity has no "off-hours" to stand out against. And its actions are attributed to a system, not a person, which defeats the audit trail's purpose.
A stolen integration credential is therefore the quiet jackpot: bulk access to workforce data through a channel nobody watches, exercised by an identity nobody questions.
Where they accumulate
Ask what integrations touch the HRIS and the first answer is usually the sanctioned list: payroll, benefits, time and attendance. The fuller inventory typically adds background check connectors, the applicant tracking sync, a reporting or analytics tool someone connected, single sign-on plumbing, a middleware platform gluing feeds together, and — the classic finding — the connector for a vendor the company stopped using two years ago, still holding a valid key.
Departmental tools compound it. A team connects a scheduling app or survey platform to the directory or HRIS through an OAuth grant, no procurement involved, and a third party now receives employee data through a path IT never saw.
The inventory is the control
Everything else depends on knowing what exists. A usable integration inventory records, per connection: what system connects to what, what data flows and in which direction, what scope the credential holds, when it was last rotated, who the internal owner is, and whether the business purpose still exists.
Building it the first time reliably produces the uncomfortable findings — that is the point. Connections with no owner, scopes nobody can justify, and credentials from implementations past are all standing exposure that costs nothing to close except the attention to find it.
Practices that keep it governed
- Minimum scope at creation. An integration that needs demographic fields should not hold compensation and banking access because full scope was the easy checkbox. Re-scoping existing connections is tedious and worth it for the ones touching sensitive categories.
- An owner per integration, so someone answers for its existence at review time — ownerless connections default to eternal life
- Rotation on a schedule for keys and secrets, and immediately when anyone who knew them departs
- Termination tied to vendor offboarding. Ending the contract must include revoking the credential, which requires the offboarding checklist to know the credential exists — the inventory again
- Inclusion in access reviews, on the same quarterly cycle as human accounts
- Monitoring proportionate to scope — at minimum, alerting on bulk reads outside normal patterns from the connections that can perform them
The vendor-side questions
Every integration is also a data disclosure to whoever operates the other end. The diligence questions follow: how does the vendor store and protect the credential on their side, who within the vendor can use it, does data flow onward to subprocessors, and what happens to both the credential and the accumulated data at termination?
Where California residents are involved, the contractual service-provider terms privacy law requires apply to these arrangements exactly as they do to bulk file transfers — the integration is just the modern delivery mechanism.
A modest starting exercise
One afternoon: pull the connected-app and API-credential lists from the HRIS, payroll, and identity platforms; write down what each connection is for and who owns it; kill the ones with no answer; calendar a quarterly recheck. Most employers find the exercise closes more real exposure than any product purchase of equivalent effort.
Employer's Guardian helps employers inventory system connections, scope them properly, and fold them into access governance through EGPay workforce management.
This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.
