workhuman-install-auth

Imported from jeremylongshore/tons-of-skills-marketplace (skills/.curated/workhuman-install-auth/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill workhuman-install-auth. Copyright stays with the author (MIT).

Workhuman Tenant Access and Integration Onboarding

Overview

Choose the supported access model, establish ownership, and prove the smallest safe capability without guessing a host, route, grant, or credential format.

Prerequisites

• The customer tenant, subscribed products, program owner, and integration purpose
• Identity, security, data, and support owners for the affected workforce records
• Current customer-authorized Workhuman documentation or an assigned Workhuman implementation contact

Tool Discipline

Use Read, Glob, and Grep to inspect local configuration, WebFetch to re-check first-party public and authorized tenant contracts, and Write or Edit only for secretless configuration and redacted evidence.

Current Contract

Workhuman publicly documents SSO, controlled privileges, an open API, and managed integrations such as Microsoft Teams and Workday. Its public pages do not define one universal API host, OAuth flow, scope set, or verification route; obtain those details from the customer's current contract.

Authentication

Separate interactive SSO, managed-connector authorization, and API credentials. Do not reuse browser sessions, infer client_credentials, copy administrator cookies, or put secrets in files, commands, prompts, logs, or receipts.

Instructions

1. Record tenant, products, data classes, intended reads and writes, environments, and accountable owners.
2. Classify the path as interactive SSO, a Workhuman-managed integration, or a customer-issued API contract.
3. Re-fetch the applicable first-party product page and the customer's current implementation documentation.
4. Build an access matrix covering principal, roles or scopes, expiry, rotation, revocation, and break-glass ownership.
5. Search the repository for guessed hosts, undocumented routes, hard-coded secrets, and mixed-tenant configuration.
6. Present every tenant setting, connector enablement, consent, and credential request for explicit approval.
7. After authorized provisioning, run the smallest documented read-only check and retain only redacted status and correlation evidence.

Approval Boundaries

Do not change SSO, assign privileges, enable an integration, issue credentials, or test production writes without the relevant customer and vendor owners.

Output

Return the selected access path, contract evidence, access matrix, secretless configuration, verification receipt, rotation and revocation owners, and unresolved vendor questions.

Error Handling

Example

A redacted completion receipt might look like this:

tenant=customer-specific; path=managed-workday; principal=vendor-managed; contract=current; smoke=read-only-pass; secrets=redacted

Resources

• Workhuman integrations
• Workhuman security and privacy

Next Steps

Test reauthorization or credential rotation in a non-production context and assign a contract review date.