> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/access-policies-and-approvals/access-control-overview/managing-an-existing-access-control.md).

# Managing an existing access control

Every access control you create appears in the list on the **Access Control** page, under the tab for the resource type it applies to.

![The access control list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/xRR0yPBt1da6WpLARjcj/assets/01.png)

## Reading the list

Each row is one grant. It shows who holds it, what it gives them, and how it was arrived at.

| Column                   | What it tells you                                         |
| ------------------------ | --------------------------------------------------------- |
| User Name                | The user the grant applies to                             |
| App Name                 | The application, or resource, they can reach              |
| Roles                    | The role they hold in it                                  |
| Auth Types               | The authentication methods required for this access       |
| Created By / Modified By | Who made the grant and who last changed it, with the date |
| Status                   | Whether the grant is currently in effect                  |
| Actions                  | Edit and delete                                           |

Grants are separated by resource type across the tabs at the top — **Applications**, **Public Applications**, **Systems**, **Databases**, **Imported Databases**, **Cloud Resources** and **Radius Profiles**. A grant only appears under the tab matching what it points at.

Below the tabs, **User Profiles** and **Group Profiles** switch between grants made to individual users and grants made to groups. A group grant covers everyone in the group, so it is the one to check first when someone has access you cannot account for.

## Editing a grant

Select the pencil icon on the row.

![Selecting the edit icon.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/hqlfkTFPS8YQm5xbXg9d/assets/02.png)

The grant reopens on **Define Access**, with its current values filled in.

![The Edit Access control dialog.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/7kwuYO96uAwxe4c5I4MA/assets/03.png)

| Field              | What it controls                                                                                                    |
| ------------------ | ------------------------------------------------------------------------------------------------------------------- |
| User Name          | Who holds the grant. Shown read-only — to move access to a different person, create a new grant and remove this one |
| Select Application | The application this grant reaches                                                                                  |
| Select Resources   | The specific resource within that application                                                                       |
| Select Roles       | The roles the user holds in it. Remove one with the **x** on its chip, or add another from the dropdown             |
| Access Type        | **Permanent**, or **Temporary** with a validity window                                                              |

Select **Update Access control** to save.

Changing the roles on a grant changes what the user can do inside the application, not whether they can reach it. If the intention is to remove their access entirely, delete the grant instead.

{% hint style="info" %}
Switching a permanent grant to **Temporary** is the cleaner way to wind down access that should not last — the grant lapses on its own date rather than depending on someone remembering to remove it.
{% endhint %}

## Deleting a grant

Select the bin icon on the row.

![Selecting the delete icon.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/R9zA4FJqS10hW0lC2ldn/assets/04.png)

You are asked to confirm.

![Confirming deletion.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/LbaK1pS1SreqTwVNfKHc/assets/05.png)

Select **Delete** and the grant is removed. The user loses that access immediately.

Deleting removes the grant and the record of what it allowed. Where access may be needed again, set the row inactive with the **Status** toggle instead — an inactive grant is kept but not enforced, which suits a secondment, an investigation, or a system taken out of service.

## Finding a grant

Use **Search** to find a grant by user or application once the list runs long, and the column headers to sort. **Modified By** is the useful one when you are working out what changed recently.