> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Additional privileges

> Grant specific, scoped privileges to users and machine identities on top of their predefined roles.

Infisical's [role-based access controls](https://infisical.com/docs/documentation/platform/access-controls/role-based-access-controls.md) let you define predefined permission sets for [users](https://infisical.com/docs/documentation/platform/identities/user-identities.md) and [machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities.md). However, there are cases where a specific user or machine identity needs access beyond what their assigned roles provide — without creating an entirely new role.

**Additional Privileges** let you grant scoped, fine-grained permissions to individual users or machine identities within a project. Use them when you need to:

* Grant access to a specific secret path that the member's current role doesn't cover.
* Provide temporary, time-bound access for a particular task or incident.
* Layer extra permissions on top of existing roles without affecting other members who share those roles.

> [!NOTE]
>
> If you find yourself assigning the same additional privileges repeatedly, consider creating a [custom role](https://infisical.com/docs/documentation/platform/access-controls/role-based-access-controls.md) instead.

## Adding additional privileges

Additional privileges can be configured through the Infisical Dashboard or the API. The steps below apply to both users and machine identities.

> [tab] Infisical UI
>
> **1. Select the user or machine identity**
>
> Navigate to the **Access Controls** page of your project and select the user or machine identity you want to grant additional privileges to.
>
> ![Select a member](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/access-control-select-user.png)
>
> **2. Add additional privileges**
>
> In the member detail view, click the **Add Additional Privileges** button. This opens a configuration panel for the new privilege.
>
> ![Add Additional Privileges button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/user-details-add-additional-privileges-button.png)
>
> **3. Add policies**
>
> Click the **Add Policies** button to open the policy selector dropdown.
>
> ![Add Policies button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/additional-privilege-add-policies-button.png)
>
> **4. Select the policies to apply**
>
> Choose the policies you want to include in this additional privilege from the dropdown.
>
> ![Policy selector dropdown](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/additional-privilege-select-policy-dropdown.png)
>
> **5. Configure the privilege**
>
> Fill in the privilege details and configure each policy you selected:
>
> * **Privilege Name** — A slug-friendly identifier for the privilege.
> * **Duration** — How long the privilege remains active. Defaults to **Permanent**. Set a limited duration for [temporary access](https://infisical.com/docs/documentation/platform/access-controls/temporary-access.md) grants.
> * **Policies** — The specific permission policies (e.g., read/write access to certain secret paths) included in this privilege.
>
>   ![Configure policies](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/additional-privilege-configure-policies.png)
>
> **6. Save the privilege**
>
> Click **Save** to apply the additional privilege. It takes effect immediately.
>
> ![Save button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/additional-privilege-save-button.png)
>
> **7. Verify the privilege**
>
> The new additional privilege now appears in the member's detail page. You can edit or remove it at any time from here.
>
> ![Additional privilege created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/access-controls/additional-privileges/user-details-additional-privileges-created.png)

> [tab] API
>
> > [!NOTE]
> >
> > The API for managing additional privileges is only supported for machine identities. To manage additional privileges for users, use the Infisical UI.
>
> To create an additional privilege for a machine identity, make a `POST` request to the [Create Identity Privilege](https://infisical.com/docs/api-reference/endpoints/identity-specific-privilege/v2/create.md) endpoint:
>
> ```bash theme={"dark"}
> curl --request POST \
>   --url https://us.infisical.com/api/v2/identity-project-additional-privilege \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "identityId": "<identity-id>",
>     "projectId": "<project-id>",
>     "slug": "read-secrets-prod",
>     "permissions": [
>       {
>         "subject": "secrets",
>         "action": ["read", "readValue"],
>         "conditions": {
>           "environment": {
>             "$eq": "production"
>           }
>         }
>       }
>     ]
>   }'
> ```
>
> ### Sample response
>
> ```json theme={"dark"}
> {
>   "privilege": {
>     "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
>     "slug": "read-secrets-prod",
>     "isTemporary": false,
>     "temporaryMode": null,
>     "temporaryRange": null,
>     "temporaryAccessStartTime": null,
>     "temporaryAccessEndTime": null,
>     "permissions": [
>       {
>         "subject": "secrets",
>         "action": ["read", "readValue"],
>         "conditions": {
>           "environment": {
>             "$eq": "production"
>           }
>         }
>       }
>     ],
>     "createdAt": "2024-09-01T12:00:00.000Z",
>     "updatedAt": "2024-09-01T12:00:00.000Z"
>   }
> }
> ```
>
> For the full list of request parameters, supported subjects, actions, and condition operators, see the [API reference](https://infisical.com/docs/api-reference/endpoints/identity-specific-privilege/v2/create.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.