Bind entities, secrets, and AI providers

Where: Functions → create/edit a function → Configuration. You need appropriate access to both the function and the resources being bound.

The Access step selects entities, providers, and secret bindings for a function.

Entity access#

Select each entity required by the code. Choose Read for lookups and Read & write only for operations that need mutation. Check the actual property names in the entity Schema. Binding an entity does not populate it; import its rows separately.

Test a known read before adding a write. When the function is called by another user or an app, the caller's permissions and the function's runtime binding checks still matter.

Secret aliases#

Create the secret in Secrets, then select it in the function and configure the alias used by code. For a Python helper, the starter demonstrates secrets.require("ALIAS"). The alias is a name; the secret value remains stored separately.

A missing alias and a missing underlying credential are different failures. Verify the binding name, the selected secret, and the integration's result without printing the secret to logs. Credential rotation should be followed by a new controlled run.

AI provider configuration#

Select the provider needed by the function and configure model/generation settings where exposed. Check the actual available model list for that provider. A provider visible in an interactive model picker does not necessarily mean it is bound to this function.

Use Providers to create or edit a service configuration. A function with no AI operation can be tested through Raw input without calling an AI service.

Test the dependency boundary#

Use one small input that exercises each binding. Inspect the returned data, changed records, or integration response. If access is denied, record the function, resource, caller, and attempted operation before changing grants.

For secrets required by a package installation, bind destination secrets during package setup. Do not assume the package contains the publisher's secret values.