One shared computer, least privilege

Here is a fact with real consequences for anyone running more than one Bot: all of your Bots share one cloud computer assigned to your account. The documentation is explicit that files, browser sessions, and command-line credentials on that computer are available across your whole Bot roster. A login that one routine signs into is reachable by every other Bot and routine you have.

The first lesson most people take from this is the wrong one. They think: "I'll put the risky routine on a separate Bot to wall it off." The docs shut that down directly: do not use separate Bots as a security boundary. Separate Bots are an organizing convenience, not an isolation wall — they all reach into the same shared computer. So the boundary has to come from least privilege, not from which Bot owns the routine.

What least privilege looks like in practice, straight from the guidance:

• Connect only the tools a workflow needs. Every connector you add is another door into that shared computer. A routine that reads GitHub doesn't need your email connected.
• Use scoped service accounts where the source system supports them. Give a routine a read-only or narrowly-scoped account rather than your full-access personal one, so even a misbehaving routine can't reach past its job.
• Start read-only and draft. New routines should look and propose before they ever write, and keep sending, publishing, purchasing, deletion, and production changes behind approval.
• Sign out of a service when it should no longer be available, and remove sensitive temporary files after the work is done. Because the computer is shared and persistent, a login you leave signed in stays reachable until you sign it out.
• Review installed connectors and active routines regularly, and remove the ones you no longer use.

There's a cleanup sequence worth knowing for when a project or login should go away: pause or delete the related routines, sign out of the websites on the shared computer, uninstall connectors and revoke their access in the source service, and remove sensitive files. Note one gotcha the docs call out: deleting a Bot does not remove shared-computer files or browser sessions. So "I deleted the Bot" is not the same as "I cleaned up its access." The access lives on the shared computer, and you clear it there.

The mindset: treat the shared computer like a shared workbench in a shop. Anyone's tool can reach anything left on it. So you only put out what the current job needs, and you put things away when you're done.