Cross-workspace sharing for Event Streams ​

Cross-workspace grants let a Workato workspace share specific Event streams topics with other workspaces in the same Automation HQ organization. A source workspace admin defines a grant that names the topics to share, the workspaces that receive the topics, and the access level for each topic. Target workspaces can then consume the shared topics in recipes without recreating the topic infrastructure locally.

Cross-workspace grants are designed for hub-and-spoke and centralized event-driven patterns. For example, a central integration hub that publishes order or employee-lifecycle events to regional or functional spoke workspaces.

How cross-workspace grants work ​

A cross-workspace grant is a one-directional asset-sharing relationship. The source workspace owns the topics and defines access. The target workspace consumes those topics in recipes. The following workspace-level actors are involved:

• The AHQ admin enables and disables cross-workspace sharing for the entire managed-workspaces organization. No grants can be created or used when sharing is disabled. Every managed workspace in the organization can grant access to any other workspace when sharing is enabled.
• The source workspace admin creates the grant. They choose which topics to share, which target workspaces receive access, and what each target workspace is allowed to do with each topic.
• The target workspace admin and recipe builders consume the shared topics. Shared topics appear automatically in the target workspace. No acceptance workflow is required.

Grant lifecycle ​

A grant moves through the following states:

• Active: The grant exists in the source workspace. Topics are visible and usable in the target workspaces.
• Updated: The source admin has added or removed topics, added or removed workspaces, or changed access levels. Changes propagate to target workspaces immediately. Active recipe connections continue to run. Updated permissions apply at the next connection attempt.
• Revoked: The source admin has deleted the grant. Topics are removed from target workspaces. Recipes that were using a revoked topic show errors at their next connection attempt. Runs that are already in progress complete.

There is no active or inactive toggle state for grants. You must delete the grant to pause sharing and recreate it when you plan to resume sharing.

Permissions model ​

Cross-workspace grants are controlled by the Cross-workspace sharing environment-level privilege. A collaborator with the Cross-workspace sharing privilege can manage grants for any topic in the workspace.

Permissions stack across grants. If a target workspace has a grant with publish access to a topic, that workspace can publish to the topic, regardless of other grant access definitions. Removing one grant only revokes access when no other grant on the same topic provides the same permission.

Access levels ​

Each topic in a grant carries an access level that controls what the target workspace can do with it:

• Subscribe: Allows the target workspace to consume messages from the topic in recipe triggers.
• Publish: Allows the target workspace to publish messages to the topic from recipe actions.

Access levels are assigned per topic, not per grant. One grant can include some topics with Subscribe access and others with Publish access, or both for the same topic.

Environment visibility ​

A source admin's environment role determines which environments they can view and configure on the grant management screens.

• A grant appears in the Grants list only when it includes at least one environment the admin can access. The environment tags on each grant card show only the environments the admin can access.
• Each grant card has highlighted environment badges when the environment has at least one topic and at least one workspace configured.
• The grant detail page displays only the environment sections the admin can access. Inaccessible environments are omitted.

Prerequisites ​

Ensure the following before any workspace in your organization can use cross-workspace grants:

• Your organization uses Automation HQ. Non-AHQ customers can't use cross-workspace grants.
• The source and target workspaces are in the same data center.
• The AHQ admin has enabled cross-workspace grants for the organization. Refer to Enable cross-workspace grants.
• Admins who plan to create grants hold the Cross-workspace sharing privilege on the relevant environment.
• Create the Event streams topics in the source workspace before creating the grant. Topics must exist in each environment where you plan to share them.

Supported environments ​

Cross-workspace grants support every environment type.

Grants are environment-to-environment. A topic shared in the source workspace's Dev environment is accessible only in the matching Dev environment of each target workspace. Sharing across different environments isn't supported.

Roles and permissions ​

Three roles interact with the feature. Each role performs different actions, and procedures are organized by role.

Automation HQ admin ​

The AHQ admin controls the master toggle that enables or disables cross-workspace grants for the entire organization. The AHQ admin doesn't create individual grants. The AHQ admin performs the following:

• Enable cross-workspace grants for the managed-workspace organization.
• Disable cross-workspace grants when sharing should be turned off across all managed workspaces.

Source workspace admin ​

The source workspace admin owns the topics being shared and controls every aspect of the grant. They perform the following:

• Create a grant that specifies which workspaces receive access, which topics are shared, and what each target workspace can do with each topic.
• Edit a grant to add or remove topics, add or remove target workspaces, or change access levels.
• Delete a grant to revoke access.
• Confirm the same grant exists in the destination environment before a target workspace promotes a recipe package that depends on shared topics.

Target workspace admin and recipe builders ​

The target workspace admin reviews incoming grants. Recipe builders consume the shared topics. They perform the following:

• Review incoming grants in workspace settings.
• Select shared topics in the recipe builder's Event streams connector to build triggers and actions.

Target workspaces don't need to accept incoming grants. Shared topics become available immediately when the source workspace admin saves the grant.

Enable cross-workspace grants ​

The AHQ admin enables cross-workspace grants from the Automation HQ settings. Every managed workspace in the organization can create grants for every other workspace when the setting is enabled.

Complete the following steps to enable cross-workspace grants:

Disable cross-workspace grants for the organization ​

Disabling cross-workspace grants deletes every active grant across the organization, removes target workspaces' access to shared topics, and causes errors in recipes that depend on shared topics.

Complete the following steps to disable cross-workspace grants:

Create a grant ​

Source workspace admins create a grant to give other workspaces access to specific topics. A grant has separate configurations for each environment you select. You can configure multiple environments at once during creation, or create the grant first and configure additional environments later.

Complete the following steps to create a grant:

Empty states ​

The topic step displays an empty state if the environment you are configuring doesn't have Event streams topics. Create topics in the source workspace first, then return to the grant to add them.

The workspace step displays a No workspaces available empty state if your organization has no other managed workspaces.

Edit a grant ​

Source workspace admins can modify an existing grant to adjust which topics it includes, which workspaces receive access, what access level applies to each topic, or the grant's name and description. Changes save when you click Save inside the dialog you are editing. There isn't a separate Save button on the grant detail page.

Complete the following steps to edit a grant:

Delete a grant ​

Deleting a grant removes all access for every target workspace listed in the grant. Topics are removed from target workspaces. Recipes that use those topics show errors at their next connection attempt. Runs that are already in progress complete.

Complete the following steps to delete a grant:

Review incoming grants in a target workspace ​

Target workspace admins review incoming grants in workspace settings. Incoming grants are grants from other workspaces that give this workspace access to shared topics. The Incoming grants tab displays the grant name, source workspace, environments, and the date and source of the access grant.

Complete the following steps to review incoming grants:

Search, filter, and sort grants ​

You can use the following capabilities on the Incoming grants tab to find a grant:

• Search grants to find a grant by name.
• All workspaces to filter by source workspace.
• Sort by: Latest activity to change the sort order.

Unavailable topics ​

A shared topic can become unavailable to your workspace when the source admin removes the topic from the grant, deletes the grant, or deletes the topic or its project. The AHQ admin can also disable cross-workspace grants for the entire organization, which removes all shared topics.

Unavailable topics are removed from the topic picker in the recipe editor after the recipe is stopped, and can't be selected in new recipes.

Deploying recipes that use shared topics ​

Recipes that use shared topics work the same way in deployment packages as any other recipe, with one extra requirement. The destination environment must already have a grant that gives the target workspace access to the same shared topic. Grants aren't part of RLCM manifests, so the source admin must create the grant in each environment independently.

Workato warns you about this at two points before deployment, and validates at deployment time:

• When you add a recipe to a package. A warning lists each shared topic and its source workspace. The warning is informational and doesn't block adding the recipe.
• When you review the package before deploying. The package summary includes a Shared topic dependencies section listing all shared topics across all recipes in the package, with a reminder to confirm grants exist in the destination environment.
• At deployment. The deployment fails with an error listing each missing topic and source workspace if a required grant is missing in the destination environment.

Resolve a missing-grant deployment failure by contacting the source workspace admin and asking them to create a grant in the destination environment that gives your workspace access to the same topics. The grant name in the destination environment must match the grant name expected by the recipe. Retry the deployment after the grant is created.

Limitations ​

Cross-workspace grants have the following limitations:

• You can only share Event streams topics. Grants don't support files, data tables, or other asset types.
• Grants don't have an active or inactive toggle state. Delete the grant and recreate it when needed to pause sharing.