One email address, four lookups, one drafted reply

Why does bypassing rules change the calculation?

Because the safety net you have been maintaining does not apply.

If your rules prevent a user from reading another user’s documents, that protection is not present on this connection. Every collection is readable and, if the action set includes writes, writable.

So treat it the way you treat a server credential in your own codebase: carefully, with as little scope as the platform allows. If you can point the connection at a separate Firebase project holding non-production data, do that. The security page covers how the credential itself is handled once connected.

What can a companion do once Firebase is connected?

The actions Firebase Admin’s API exposes, listed in the Available tools section of the app’s detail page under `strawberry://settings/integrations`, with the read-only ones marked. Read that list more carefully here than on most apps, because admin-level actions on user records have consequences no rules layer will soften.

The Permissions block on the same page is where the real configuration happens. Anything touching Authentication users, anything deleting documents, anything writing to a collection your app reads on startup: Ask every time at minimum, switched off if no named workflow needs it. Consequential steps stop at an approval card regardless.

• Prefer a non-production Firebase project for the connection if you have one.
• Reads across Firestore and Authentication: useful, and where most of the value sits.
• User record writes and document deletes: switched off unless a specific task needs them.
• Remember that Firestore has no transaction log you can walk back from a console.

The support lookup is the everyday win

A ticket names an email.

The answer involves the auth record, a user document, a subscription document and a feature flag in a fourth place. Four lookups and a paragraph, twenty times a week, and every one of them is somebody clicking through the console.

A companion holding the connection plus your signed-in support tool does the lookups and drafts the reply, for all twenty. That is support triage with real data behind it, and ai for support teams covers who benefits.

Frequently asked questions