No, your Zapier integration user doesn't need system admin rights
Today a vendor told me her “understanding” was that we had to give system admin rights to a Zapier integration user… and demanded it be done by tomorrow.
I immediately (and perhaps a bit righteously) refused. And cited recent breaches of billion-dollar corporations coming through Connected Apps just like the one we’re configuring. Her “understanding” came from a subcontractor (Pakistan, Gmail address, no Salesforce integration experience) who was in over his head.
In today’s interconnected world, every external connection into your Salesforce org is a potential attack surface. You cannot afford to hand out permissions based on flippant judgment calls.
Make sure you have someone you trust in your corner to vet these integrations. Otherwise you may find yourself answering uncomfortable questions from your customers—or in our case, the SEC.
————————————————————
Need support like that? Codality has your back—reach out to see how we can help fill the gaps of your in-house expertise.
Jessie Grenfell
Jessie has spent 20+ years architecting and delivering software for organizations where complexity is the norm: financial services, insurance, nonprofits, and regulated industries where getting it wrong isn’t an option. She specializes in the hard problems: unique operational workflows, cross-system integrations, and compliance requirements (HIPAA, CCPA, SOC 2) built into the design from the first conversation.
Her AI work comes out of that background. She has shipped AI to production, not just piloted it: a multi-agent research pipeline that cut a client’s investigation time from over an hour to minutes, and natural-language analytics that let executives ask plain-English questions of their operational data and get validated charts back. Years building business critical systems taught her where AI belongs in a business process and where it doesn’t.
At Codality, she leads engagements from discovery through delivery, because she’s seen what happens when that thread gets cut.