Connection Access
Choose whether every Member can self-add any Agent Connection, or only the ones you allow for their User Groups.
Connection access is the org-wide setting that decides which Agent Connections a Member can see and add. It has two values. Open leaves the catalog available to everyone. Curated limits each User Group to the Agent Connections you allow it, so a sensitive Connection reaches only the groups that should have it.
Curated works off the User Groups that already sync from your HRIS or IdP, so access follows your own org structure without a second place to maintain.
📖 Key concepts
Open: The default. Every Member sees and can self-add every active Agent Connection.
Curated: Members see only the Agent Connections allowed for their User Groups.
Allowed Connection: A pairing of one User Group with one Agent Connection. A Member of that group can add and use that Connection.
Union across groups: A Member gets every Connection allowed for any group they belong to. Joining a group only widens access.
Restricted: The state of a Connection a Member holds but no longer has access to. Their credential is kept and Agent access is blocked. See Connection and Agent Statuses.
💡 Why this matters: Under Open, any Member can point an Agent at any Connection in your catalog. Curated is how you make Cakewalk the gate: an Agent reaches a Connection only when the Member's group is allowed it.
⚙️ Choose a mode
Navigation: Settings → Connection access.
What you see: two cards, Open and Curated, with the active one selected.
Actions:
Select Curated to start the setup flow.
Select Open to lift every restriction.
Manage access (on the Curated card, once Curated is on): reopens the setup screen to change what each group is allowed.
Nothing changes for your org until you finish setup and confirm. Open is the default for every account and stays that way until an Admin switches.
🔒 Turn on Curated
Selecting Curated opens Setup curated access, a full screen with your User Groups on the left and, for the group you select, every Agent Connection in your catalog on the right.
Cakewalk proposes a starting point so the switch does not cut anyone off: a Connection is switched on for a group when at least one member of that group already has access to it. Because access is the union across a Member's groups, no Member loses a Connection they hold at the moment you turn Curated on. What changes immediately is the catalog each group can add from, which narrows to the set you leave switched on.
Review each group
Select a group on the left. Use the search box to find one by name. The connections table shows:
Connection and Description: the Agent Connection.
Accesses: group members who have access to this app.
Connections: group members who set up this Connection in Cakewalk.
Access: the toggle that allows or blocks this Connection for the selected group.
The two counts differ on purpose. A Member can hold access to an app and never have connected it in Cakewalk.
Set what each group is allowed
Toggle a row to allow or block one Connection for the selected group. Use the toggle in the column header to switch every row for that group at once. Switch off all connections for {n} groups in the footer clears every group, so you can build the list up from nothing.
Your changes are held while you move between groups. Nothing is saved until you finish.
🔄 What happens when access changes
You allow a Connection for a group
Members of that group can add it. Any Connection they hold that was Restricted is released and usable again straight away, with no need to sign in.
You block a Connection for a group
Members lose it unless another of their groups still allows it. A Connection they already hold becomes Restricted.
A Member joins a group
They gain everything that group is allowed, on top of what they already had.
A Member leaves a group
They keep whatever their remaining groups allow, and lose the rest.
You switch back to Open
Every Restricted Connection is released and usable again. Connections a Member paused themselves stay paused.
Group membership arrives through your HRIS or IdP sync, so these changes apply on their own as your directory changes.
👤 What a Member sees
The Add connection panel lists only the Agent Connections their groups are allowed. Everything else is absent from the catalog.
A Connection they already hold that is no longer allowed keeps its card in My Connections with a Restricted chip, under the Paused tab. Hovering the chip explains why.
The only action on a Restricted card is View details. A Member cannot resume it, and cannot connect it. Only a change to what their groups are allowed brings it back.
Nothing is deleted. The credential stays in the vault, which is why access resumes without a fresh sign in.
➕ Creating a Connection while Curated is on
Under Curated, a new Agent Connection needs a group before it can be used, so the creation flows ask for one:
From the catalog: the User groups field appears for each Connection you select. Confirm stays unavailable until every selected Connection has at least one group.
A custom Connection: the User groups field appears in the form and is required to save. See Add a Custom Connection.
Once created, the Connection's groups are listed on its detail page under All Connections.
🔗 Related pages
Last updated
Was this helpful?