> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> Control who can manage PAM and who can connect to each account.

Access to Infisical PAM has two levels:

* **Product membership** makes someone a member of PAM and decides whether they can manage PAM itself
* **Folder and account memberships** decide what someone can do with the accounts in a folder, such as connect to them

Users, groups, and [machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) need both. An [AI agent](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md) has no access of its own and uses the access of the user or machine identity that starts it.

## Product membership

A product membership gives a user, group, or machine identity one of two roles in PAM:

| Role | What it allows |
| - | - |
| **Admin** | Manage account templates, folders, and product members |
| **Member** | Use PAM, with access only to the folders and accounts they have a role on |

A product admin can't connect to an account unless they also have a role on the account or its folder.

### Add product members

**Step 1**

Go to **Privileged Access Management** > **Access Control**.

**Step 2**

Select the tab for the kind of member you're adding, then select the button on that tab:

* **Members**: **Invite Member**
* **Groups**: **Add Group**
* **Identities**: **Add Identity**

**Step 3**

Select the users, group, or identity, choose **Admin** or **Member**, and confirm.

On the **Identities** tab, you can also create a new machine identity for PAM. To learn how an AI agent uses one, see [Run agents unattended](https://infisical.com/docs/documentation/platform/pam/ai-agents/unattended.md).

### Organization admins

When your organization first opens PAM, everyone with the organization Admin role at that moment becomes a product admin.

If you get the organization Admin role later, you aren't a member of PAM yet. Open **Privileged Access Management** and select **Join as Admin** to add yourself as a product admin. You can also [join any folder as its Admin](https://infisical.com/docs/documentation/platform/pam/folders/overview.md#join-a-folder-as-an-organization-admin).

## Folder and account memberships

A folder or account membership gives a product member one of the following roles on a [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) or an [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md):

| Role | What it allows |
| - | - |
| **Admin** | Manage the accounts, sessions, and memberships in the folder or account |
| **Operator** | Launch sessions and [view account credentials](https://infisical.com/docs/documentation/platform/pam/accounts/view-credentials.md) |
| **Connector** | Launch sessions and request access to accounts that need approval |
| **Auditor** | View audit logs and session recordings |

Infisical records a session for every connection, but not what someone does with a credential they've viewed. Give the Operator role only to people who need the credential itself.

### Folder or account

A role on a folder applies to every account in the folder, including accounts added later. Grant access on folders whenever you can.

A role on an account applies to that account only. Use it when someone needs one account in a folder but not the others, such as a contractor who needs one database.

### Assign a role

**Step 1**

Go to **Privileged Access Management** > **Accounts**.

**Step 2**

Open the options menu on the folder's or account's row and select **Configure**, then select the **Permissions** tab.

**Step 3**

Select **Assign Access**.

**Step 4**

Choose the **Assignee** and the **Role**. To remove the access automatically after a set time, choose an **Expiry**.

**Step 5**

Select **Assign**.

The **Assignee** list only includes product members. To give a role to someone who isn't in the list, [add them to PAM](#add-product-members) first.

If you assign a role to a group, the role follows the group's membership. When someone joins or leaves the group, including through a sync from an identity provider such as Okta or Microsoft Entra ID, their access changes with it.

### What machine identities can't do

Machine identities can hold any role, but the following stay with users and groups:

* **Connecting in the browser**: Machine identities connect through the [CLI](https://infisical.com/docs/cli/reference.md#pam-agentic-access)
* **Approving access requests**: A machine identity can request access, but only users and groups can [approve requests](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md)
* **Accounts that require MFA**: A machine identity can't complete an MFA challenge, so it can't connect to an account whose template requires MFA

## Example setup

The following example gives a platform team access to its databases:

1. A product admin adds the platform team's lead to PAM as a **Member**
2. The product admin creates a `platform-team` folder and gives the team lead the **Admin** role on it
3. The team lead adds the team's accounts to the folder
4. The team lead gives the rest of the team the **Connector** role on the folder

The team can then connect to every account in the folder, and the team lead manages the folder's access without involving the product admin.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.