Attio
Use CRM vendor records as evidence for supplier reviews without granting general write access.
Create the evidence token
Create a dedicated Attio token with:
user_management:readobject_configuration:readrecord_permission:read
If the vendor register uses a list, also grant read access to its list configuration and entries.
Map the vendor register
In Sparta, select the register's object or list slug. Map the attribute slugs for vendor name, risk tier, data access, last security review and signed DPA status.
Check these mappings against actual records before collecting evidence. A field existing in Attio does not establish that its contents are complete or current.
Run the connection check and inspect missing reviews or incomplete vendor records on the affected controls.
Optional notes
Attio note creation uses a separate ATTIO_NOTES_API_KEY Worker secret. Grant note read/write, object-configuration read and record read permissions only when enabling that workflow.