---
title: "Access & Accounts Checklist"
slug: onboarding-access-checklist
section: Developer Onboarding
status: stable
description: "Every system a new Alliance Abroad contributor needs before they can be productive — what it's for, and how to actually get it."
last-updated: 2026-10-07
---

# Access & Accounts Checklist

Every system a new Alliance Abroad contributor needs before they can be productive — what it's for, and how to actually get it. Work through this before (or during) your first few days.

## Overview

Alliance's tooling is deliberately consolidated behind a small number of entry points — the Alliance MCP Gateway is the biggest lever, since one PAT unlocks dozens of downstream tools. Get that early; most of the rest follows from it.

## The Checklist

| System | What it's for | How to get it |
| --- | --- | --- |
| GitHub org (`Alliance-Strategies`) | Read/write access to every Alliance repo — BackOfficePrototype, PPPToo, HostPortalPrototype, n8n-workflows, and more | Ask your manager to add you to the org. If push/pull fails with "Bad credentials," generate a personal access token and update your git remote — see the `github-credentials-fix` process. |
| Alliance MCP Gateway | Single MCP endpoint for Teams, GCP, Nexus, GitHub, Asana, and every other Alliance tool, role-gated | Robot/agent callers: get a PAT (`aag-pat-...`) from the admin portal (Users & Roles → Robot PATs). Human callers: sign in with Alliance SSO. Never commit a PAT — store it in 1Password or Secret Manager. |
| Nexus (Ecosystem Governance Hub) | The architecture and onboarding doc site you're reading right now | `nexus.allianceabroad.com`, SSO-gated via Microsoft Entra — no separate signup needed. |
| AAG MCP @ connector (ChatGPT) | Conversational Q&A over the whole Globus ecosystem — the guided onboarding path | ChatGPT → Settings → Apps → search "AAG MCP @" → Connect → authenticate with your company Microsoft/Entra account. It must be explicitly selected as the active source before asking Globus-specific questions. |
| 1Password vaults (Globus Dev, Globus QA, alliance-mcp-services) | Shared credentials for local dev and testing — including the dedicated E2E bot accounts | Requested via your manager or the platform engineer; you're added to the vault(s) relevant to your work. |
| GCP IAM (`skilled-script-469819-f2` dev project, `alliance-mcp-services`) | Console/CLI access to Cloud Run, GKE, Cloud SQL, and Secret Manager for the environments you touch | Requested via the platform engineer. Access is scoped per environment — development is the default starting point; QA/prod access is granted separately as needed. |
| Asana workspace | Ticket tracking — where all implementation work is scoped, assigned, and closed out | Invited by your manager. Orient yourself with the Asana Ticket Standard page (In-App Help section) and find the board your initiative routes through. |
| Microsoft Teams | Platform Pulse channel (automated alerts) + the engineering team chat (human coordination) | Standard company Microsoft 365 account. Ask to be added to the Platform Pulse channel and the engineering group chat. |
| Replit | Some services are developed/iterated in Replit before landing in GitHub | Requested per-repo, only if your work touches a Replit-hosted service. |

## Recommended Order

1. GitHub org access — you need this to read any code at all.
2. Alliance MCP Gateway PAT — this is the multiplier; it unlocks Teams, GCP, Asana, and Nexus itself through one credential.
3. Nexus — read Overview & Architecture and the Glossary before touching code.
4. AAG MCP @ connector — start asking the recommended onboarding questions (see the AAG MCP @ Connector Onboarding page).
5. 1Password vault access — needed the moment you try to run anything locally.
6. GCP IAM — needed once you're deploying or debugging against a live environment.
7. Asana + Teams — needed to pick up your first ticket and coordinate with the team.

## Personal vs Shared Credentials

The gateway uses two auth modes, and it matters which one a tool you're calling falls under:

- **Shared** — a genuinely org-wide service with one credential and no per-user concept. Only two: HubSpot and Nexus/ecosystem. Any valid gateway token uses the shared service credential.
- **Personal** — the default for everything else (Teams, GCP, Asana, GitHub, 1Password, and more). The gateway forwards *your* per-user token so you act as yourself, and no user sees another's data. If you haven't connected your own account yet, the gateway falls back to a shared service credential so the tool still works, then upgrades to your personal token once you connect.

> **Never use a real person's personal login for testing.** Portal testing (Applicant Portal, PPPToo, BackOffice) always uses the dedicated E2E bot accounts provisioned per environment — never your own or anyone else's real credentials. Resetting someone's personal password to "test" it locks them out of their real workday.

## Notes & Troubleshooting

- A gateway tool responding "requires authorisation" means that backend is personal-mode and needs you to connect it via OAuth in the setup portal first.
- 401s from the gateway mean your `Authorization: Bearer` PAT is missing or wrong — re-check your MCP client config.
- GitHub "Bad credentials" almost always means a stale PAT in your git remote, not a broken account — regenerate and `git remote set-url` rather than escalating.