> ## Documentation Index
> Fetch the complete documentation index at: https://docs.erstan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorizing your NetSuite user

> Each member authorizes their own NetSuite user so agents act with their permissions.

Connecting NetSuite happens in two stages. An owner or admin sets up the shared **Workspace OAuth connection** once, and then every member authorizes their own NetSuite user before agents can act on their behalf. This page covers that second stage — your personal authorization.

## Why authorization is per user

Erstan uses **per-user authorization** for NetSuite. When an agent calls a NetSuite tool, it calls it **as you** — using the NetSuite user and role you authorized. Your own NetSuite permissions decide what the agent can read and write.

<Info>
  Because agents inherit your NetSuite role, you only ever grant Erstan the access you already have. Two people running the same agent may see different results if their NetSuite roles differ.
</Info>

This is why the shared workspace connection alone is not enough: it establishes the OAuth client for the workspace, but each member still needs to sign in and approve access individually.

<Warning>
  When you authorize, choose a **non-Administrator role** in the NetSuite sign-in popup. Agents act with the role you pick, so a least-privilege role keeps writes scoped to the work you actually do. Writes still pause for approval based on each tool's [write policy](/connectors/netsuite-manage).
</Warning>

## Authorize your NetSuite user

You can authorize from the connector page or directly from chat when an agent needs access.

<Tabs>
  <Tab title="From the connector">
    <Steps>
      <Step title="Open the NetSuite connector">
        Go to **Connectors** in the sidebar and open **NetSuite**. The workspace connection must already be set up by an owner or admin — see [Connecting NetSuite](/connectors/netsuite).
      </Step>

      <Step title="Go to Authorizations">
        Open the **Authorizations** tab. The **Your NetSuite user** card shows your current status: **Authorization required**, **You authorized**, or **Authorization expired**.
      </Step>

      <Step title="Click Authorize">
        Click **Authorize** (or **Re-authorize** if your access expired). A NetSuite popup opens — allow popups if your browser blocks it.
      </Step>

      <Step title="Sign in and approve in NetSuite">
        Sign in to NetSuite, **choose a non-Administrator role**, and approve access. Erstan polls until the card reports **You authorized**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="From chat">
    When you ask an agent to do NetSuite work and you have not authorized yet, the conversation shows an **Authorization Required** card instead of running.

    <Steps>
      <Step title="Open the card">
        The card names the connection that needs access (NetSuite). Click **Authorize** on the card.
      </Step>

      <Step title="Approve in the popup">
        Sign in and approve in the NetSuite popup, choosing a non-Administrator role.
      </Step>

      <Step title="Continue the conversation">
        Once authorization completes, the agent resumes the work you asked for. You only need to do this once until your access expires.
      </Step>
    </Steps>

    <Note>
      An **Authorization Required** card is different from an **Approval** card (which asks you to confirm a write) and from the informational **NetSuite is busy** queue notice. See [Approving and rejecting AI actions](/chat/approvals).
    </Note>
  </Tab>
</Tabs>

## Manage or revoke your authorization

NetSuite access tokens are short-lived and refresh automatically, so you rarely re-authorize during normal use. You do need to re-authorize if your authorization shows **Authorization expired** or if your NetSuite role changes.

<AccordionGroup>
  <Accordion title="Re-authorize expired access">
    Open the NetSuite connector's **Authorizations** tab and click **Re-authorize** on the **Your NetSuite user** card. This refreshes your personal authorization without touching the workspace connection.
  </Accordion>

  <Accordion title="Disconnect your NetSuite user">
    Use **Disconnect your NetSuite user** to revoke only your personal authorization. The shared workspace connection and other members' authorizations are unaffected. Agents can no longer act as you in NetSuite until you authorize again.
  </Accordion>
</AccordionGroup>

## The Workspace members roster (owners and admins)

Owners and admins see a **Workspace members** roster on the Authorizations tab — a table of who has authorized their NetSuite user, with a summary like **3/5 members authorized**.

| Column        | What it tells you                                                                            |
| ------------- | -------------------------------------------------------------------------------------------- |
| User          | The workspace member.                                                                        |
| Role          | The NetSuite role they authorized with.                                                      |
| Authorization | Their status — **You authorized**, **Authorization required**, or **Authorization expired**. |
| Connected     | When they first authorized.                                                                  |
| Expires       | When their authorization needs renewing.                                                     |
| Last used     | The most recent agent run that acted as them.                                                |

<Tip>
  Use the roster to spot members who still show **Authorization required** before assigning them NetSuite agent work, and to find expired authorizations that need a nudge to re-authorize.
</Tip>

<Note>
  Managing the workspace connection and authorizations requires the **Owner** or **Admin** role. Members can authorize their own user but cannot change the shared connection.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Connecting NetSuite" icon="plug" href="/connectors/netsuite">
    How an owner or admin sets up the shared workspace connection.
  </Card>

  <Card title="Managing NetSuite tools & write policy" icon="sliders-horizontal" href="/connectors/netsuite-manage">
    Control which tools agents can use and which actions need approval.
  </Card>

  <Card title="Approving AI actions" icon="shield-check" href="/chat/approvals">
    Review and approve writes before they run in NetSuite.
  </Card>

  <Card title="Security & write safety" icon="lock" href="/security/overview">
    How per-user authorization and approvals keep you in control.
  </Card>
</CardGroup>