> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Access requests > Require approval before a member can use a sensitive account. Access requests add an approval step to sensitive [accounts](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md), such as a production database or a domain admin account. If an account requires approval, a member who already has access to it must request access and wait for an approver each time they need the account. The same rule applies to [AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md). An agent requests access as whoever started it, a person or a [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md), and waits for an approver. ## How approval works Approval adds to the access that a member already has. To use an account that requires approval, a member needs both of the following: * **A role on the account:** The Admin, Operator, or Connector [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the account or its [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md), which decides who can use the account at all * **An approved request:** A request that an approver has approved, which gives the member access for the duration they asked for A member can only request access to an account they already have a role on. When the duration ends, the member loses access until they file another request. ### Session and credential requests Members request two kinds of access separately: * **Session access:** Launch [sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview) on the account * **Credential access:** [View the account's credentials](https://infisical.com/docs/documentation/platform/pam/accounts/view-credentials.md), which needs the Operator or Admin role An approved session request doesn't reveal the credential, and an approved credential request doesn't let the member launch a session. A member who needs both files two requests. ## Set up approval An account requires approval when its [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) has **Require Approval** turned on. The approvers are set on the account's folder, so a Product Admin and an Admin of the folder each do part of the setup. **Step 1** As a [Product Admin](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership), go to **Privileged Access Management** > **Account Templates**, open the template for the account type, and turn on **Require Approval**. **Step 2** As an Admin of the folder, add the account to the folder with that template. If the account already exists, a Product Admin must [change its template](https://infisical.com/docs/documentation/platform/pam/accounts/manage.md#change-the-template) instead. **Step 3** Open the folder's **Approvals** tab, add the users or groups who can approve requests under **Approvers**, and select **Save Changes**. Approvers must already be members of the folder, which you add on the folder's **Permissions** tab. An approver doesn't need a role that lets them use the account. Only users and groups can be approvers. A machine identity can't approve a request, even if it has the Admin role on the folder. > [!WARNING] > > Members can't request access to an account that requires approval until its folder has at least one approver. ## Request access On the **Accounts** page, an account that requires approval shows a key icon instead of the launch icon. **Step 1** Select the key icon on the account's row. To request the credential instead of a session, open the account's menu and select **Request Credentials**. **Step 2** Enter a **Reason**, which approvers see and the audit log records. The reason is required if the template has **Require Reason** turned on. **Step 3** Choose how long you need access, from 15 minutes to 1 week, and select **Request session access** or **Request credentials**. If the account can be [auto-approved](https://infisical.com/docs/documentation/platform/pam/access-requests/auto-approval.md), the form also has optional fields for linking records, such as a Jira ticket. A request whose records pass one of the folder's rules is approved as soon as you submit it. While the request waits for an approver, the account shows a clock icon. After an approver approves the request, the account shows the launch icon until the access expires. You can't change the reason or the duration after you submit the request. To change either one, ask an approver to deny the request, then file a new one. ## Review a request When a member requests access, Infisical notifies the folder's approvers by email and in Infisical. **Step 1** Go to **Privileged Access Management** > **Approval Requests** and select the request. **Step 2** Check the requester, the account, the reason, and the duration. If the request is for credential access, approving it lets the requester read the password or key outside a recorded session. **Step 3** Optionally, enter an **Approval comment** for the requester, then select **Approve** or **Deny**. One approval from any of the folder's approvers is enough. You can't approve a request that you filed yourself. ## Request statuses | Status | Meaning | | - | - | | **Pending Review** | The request is waiting for an approver | | **Approved** | An approver or an [auto-approval rule](https://infisical.com/docs/documentation/platform/pam/access-requests/auto-approval.md) approved the request, and the access is active | | **Rejected** | An approver denied the request | | **Expired** | The requested duration ended | | **Revoked** | An Admin of the folder ended the access before the duration ended | The duration starts when an approver approves the request, not when the member files it, so the member always gets the full duration they asked for. To see every request for a folder's accounts, open the folder's **Approvals** tab and go to **Access Requests**. ## Revoke access An Admin of the folder can end an approved request before its duration ends. On the folder's **Approvals** tab, go to **Access Requests** and select **Revoke access** on the request's row. If you revoke a session request, Infisical ends the member's active sessions on the account immediately. If you revoke a credential request, the member can't reveal the credential again, but a credential they already copied stays valid until you [rotate](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md) the account. ## Alerts An alert notifies your team about access requests in a folder through email, Slack, a webhook, or PagerDuty. Each alert watches one of the following events: | Event | When the alert fires | | - | - | | **Access Requested** | A member requests access to an account in the folder | | **Request Approved** | An approver or an auto-approval rule approves a request | | **Request Denied** | An approver denies a request | | **Break-Glass Used** | A member uses [break-glass access](https://infisical.com/docs/documentation/platform/pam/access-requests/break-glass.md) to skip the approvers | To add an alert, open the folder's **Approvals** tab, select **Alerts**, and select **Add Alert**. A folder can have one alert for each event. > [!NOTE] > > Slack, webhook, and PagerDuty channels need the Enterprise plan. Email channels are available on every plan. ## Requests from AI agents An AI agent requests access through the [CLI](https://infisical.com/docs/cli/reference.md#pam-agentic-access). If the agent runs as you, the request is filed under your name. If the agent runs as a machine identity, the request shows the identity's name. The first time an agent connects to an account that requires approval, the CLI files a request for the agent. After an approver approves the request, the agent's next connection to the account works. > [!WARNING] > > When you approve a request from an agent, you approve everything the agent does with the access for the duration you grant. Give an agent's machine identity a role on only the accounts it needs, and review its [session recordings](https://infisical.com/docs/documentation/platform/pam/sessions/session-recording.md). ## Frequently asked questions > [accordion] What happens if the account moves while a request is pending? > > If the account is deleted, Infisical cancels the request. > > If the account moves to another folder, Infisical won't approve the request, and the member can't file a new one while it's pending. An approver of the old folder must deny the old request first. The member can then file a new request, which goes to the approvers of the account's current folder. > [accordion] Do changes to a folder's approvers apply to pending requests? > > If you remove an approver, they can't act on pending requests from that point on. If you add an approver, they can only act on requests filed after you added them. An approved request keeps its access until it expires or an Admin of the folder revokes it. ## Next steps > [card] [Break-glass access](https://infisical.com/docs/documentation/platform/pam/access-requests/break-glass.md) > > Let named responders grant themselves access in an emergency. > [card] [Account templates](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) > > Set the rules for connecting to the accounts that use a template. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.