> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/access-policies-and-approvals.md).

# Access policies and approvals

Registering an application makes it exist. It does not give anyone access to it. This step is where access is actually granted — and where you decide whether it is granted directly or only after someone approves it.

Two mechanisms work together:

* **Access control** is the standing grant. It says which users, groups, or departments may reach a given resource, and it takes effect immediately. Access controls are managed under **Access Management → Access Control**.
* **Approvals** is the request path. Rather than an administrator granting access up front, a user asks for it and a named approver decides. Approvals are handled under the **Approvals** menu.

Use access control for access people should simply have because of who they are — the standing entitlements that come with a department or a job. Use approvals for access that should be requested, justified, and recorded — anything sensitive, temporary, or granted by exception.

## Do this after applications and groups

An access control points at a resource and at the users who may reach it, so both have to exist first: register the application under **Register and configure applications**, and set up the groups and departments under **Groups, departments and roles**. Assigning a group rather than a list of individuals is what stops this becoming maintenance work later.

## What you can put an access control on

The Access Control page separates grants by resource type, one tab each:

| Tab                 | Grants access to                                        |
| ------------------- | ------------------------------------------------------- |
| Applications        | Applications registered under Manage Resources          |
| Public Applications | Applications reachable without an authenticated session |
| Systems             | Servers and infrastructure targets                      |
| Databases           | Database instances                                      |
| Imported Databases  | Database instances brought in from a connected source   |
| Cloud Resources     | Cloud accounts and the resources under them             |
| Radius Profiles     | RADIUS-authenticated network access                     |

Every tab works the same way: the same list, the same columns, the same edit and delete actions. What changes is the resource picker when you create a grant — an application and its roles on one tab, a system and a privileged account on another.

## Order of work

{% stepper %}
{% step %}

### Create access controls

Create the access controls that grant standing access, starting with the applications most people need.
{% endstep %}

{% step %}

### Confirm the grant

Confirm what each access control grants by opening it again after saving.
{% endstep %}

{% step %}

### Set up approvals

Set up approvals for access that should be requested rather than granted.
{% endstep %}
{% endstepper %}

Whatever you grant here is what an access review will later ask someone to confirm, and what the access reports will show. Granting access to a group rather than to individuals keeps all three readable.

## In this section

| Page                                          | What it covers                                          |
| --------------------------------------------- | ------------------------------------------------------- |
| Access control overview                       | What an access control is, and the Access Control page  |
| Creating an access control for an application | Creating a new access control and assigning it          |
| Managing an existing access control           | Reading the list, editing a grant, and deleting one     |
| Public application access control             | Grants on publicly reachable applications               |
| System access control                         | Grants on systems and infrastructure targets            |
| Approvals                                     | Requesting access, and approving or rejecting a request |

The remaining tabs — Databases, Imported Databases, Cloud Resources, and Radius Profiles — follow the application and system pages step for step, with their own resource picker in place of the application one.