Roles that map to reality
Clay roles are admin, builder (editor), and viewer. Map them to functions, not people:
- Admins (few): manage integrations, API keys, billing, workspace settings. Usually RevOps lead plus one backup.
- Builders: create and edit workflows in their domain. Enterprise workspaces can use user groups to scope access by use case.
- Viewers: consume tables and dashboards without edit rights — most of the org belongs here.
Separation patterns
Separate by data sensitivity and blast radius: a workbook writing to production CRM is a different concern from exploratory research tables. Enterprise plans support environment-style discipline via user groups, workbook credit limits, and workflow limits — configure these deliberately rather than at default.
Credential hygiene
- Provider API keys live in Clay's integration settings — never in table columns, formulas, or docs.
- One key per provider per purpose, so a rotated key does not break every workflow at once.
- Keys reviewed quarterly; offboarding removes access same-day.
Need help applying this?
Describe your project and the ClayForEnterprises team will review it — the resources stay free either way.