Before
Administrators manually compared Salesforce role and folder flags with CLM group membership to determine what access should change. They also tracked changes separately and relied on manual handoffs when an account, group mapping, or provisioning operation was missing or failed.
How it works
- Read the user’s Salesforce access settings and locate the matching CLM member.
- Translate the approved flags into managed groups, compare desired and current access, and validate that every requested group exists.
- Apply only the required membership or status change, log the result, or route missing accounts and failures to the appropriate team.
Workflow details
- Access discovery: A webhook supplies a user identifier, after which the workflow reads the user’s active status, CLM requirement, role flags, and contract-folder access settings from Salesforce and finds the corresponding CLM member by email.
- Difference calculation: The workflow translates approved Salesforce flags into managed CLM groups, compares them with the member’s current groups, and calculates additions, removals, and status changes. Inactive users or users without required CLM access are assigned no managed groups.
- Validation and application: Before making a change, it checks that every requested group exists in the available CLM group catalogue. If the mapping is valid and a difference exists, it updates the CLM member while preserving applicable existing access and returns a summary of granted and removed groups.
- Exception handling and audit: Missing CLM accounts generate a request for CLM administrators to create the account. Unknown groups or rejected provisioning changes stop the update, notify support, and record the issue, while successful changes are logged against their source. The configured website demonstration replays synthetic connector responses locally.
What changed
Access decisions are calculated and validated automatically for each webhook request, and only the required CLM changes are applied. The result is immediately classified as in sync, updated, no access, account creation requested, or failed, with audit logging or support routing built into the handoff.
Work removed
Comparing Salesforce role and folder flags with CLM memberships, identifying group additions and removals, composing separate access-change records, and manually routing missing accounts or provisioning and mapping failures.
Expected outcome
Each request replaces at least two manual lookups and one access comparison with an automated reconciliation; actual time savings are not measured.
