1. Identify the data and the decision it supports
Connecting a system can reduce reconciliation work, but it also creates a new data flow and operational dependency. Start with a specific decision or workflow rather than collecting every available field. Without a defined purpose, teams struggle to justify access or identify when information is no longer needed.
- Which objects and fields will be accessed, including personal data and financial information?
- Why is each category needed, and could a narrower dataset meet the purpose?
- Will the connection only read records, or can it create or update them?
- Who owns the business purpose and approves changes to scope?
2. Distinguish provider permissions from viewer permissions
The permission to retrieve data is different from the permission to view or act on it afterwards. Review both boundaries. An authorised integration should not become a reason to distribute employee or financial records more widely than necessary.
- Which provider scopes, administrative roles and credentials are required for each intended action?
- Who can view imported information, approve operations and perform writes?
- How are organisational membership, role changes and administrator departures handled?
- Can the pilot use narrower permissions, with additional access approved only when needed?
3. Establish processing, refresh and retention expectations
Ask where data is processed and which organisations participate in delivering the service. Do not infer hosting location from a supplier's address. Freshness also matters: a periodically refreshed record should not be interpreted as a live statement about access or employment.
- Where are production data and relevant copies processed, and what transfer arrangements apply?
- How frequently is each data category updated, and how is the last successful update shown?
- What is retained for operational records, logs, evidence and backups?
- Which retention settings are configurable, and what exceptions or deletion delays require explanation?
4. Plan for errors and a controlled exit
Failures can leave a misleading partial picture or an uncertain action result. Agree who investigates errors and how users recognise stale information. Revoking a connection's credentials is not the same as removing data already imported.
- How are failed imports, mapping conflicts, duplicate records and partial updates reported?
- Can an action be retried safely, and how is its actual result verified?
- Who can revoke access, and how will the organisation confirm further access has stopped?
- How can records and evidence be exported, in which formats and with which scope?
- How is data removal requested or performed, and what contractual retention obligations remain?
5. Confirm Lojycal capabilities for the actual workspace
Lojycal supports connected operational workflows, including Jamf, Kandji and Intune action dispatch paths, identity integrations, and Personio and BambooHR employee lookups and writes. Employee writes include preflight confirmation and re-read verification. These capabilities do not establish that your workspace has a configured or live connection, or that every integration supports every operation.
Confirm provider permissions, mappings, credentials and plan or role gates. Lojycal has MFA/passkeys and tenant-scoped access controls; review how the applicable settings and organisational roles meet your requirements. Processing locations, retention commitments and contractual terms require current documentation and team confirmation.
6. Review documentation and run a bounded pilot
Fictional example: Cedar Office wants to reconcile assigned devices with employee status. Its pilot uses an approved employee subset and necessary identifiers, rather than starting with broad write permissions. HR and IT compare the results with their sources and investigate unmatched records before extending scope.
- Review current documents at /privacy, /dpa, /sub-processors and /commercial-terms, alongside provider permission documentation.
- Record unanswered questions and obtain confirmation from the team through /contact.
- Define pilot owners, baseline accuracy, success criteria and a revocation test.
- Approve expansion only after checking data coverage, authorised visibility, error handling and export or removal arrangements.