> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/access-policies-and-approvals/access-control-overview/system-access-control.md).

# System access control

Systems are granted differently from applications. Instead of a role, a user is mapped to a **privileged account** on the system — the account they will actually log in as when they open a session.

Open the **Systems** tab and select **Add Mapping**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/SgW6xWv6ws80g4atlyrO/assets/09.png)

{% stepper %}
{% step %}

## Select users

Tick one or more users to map to the system, then select **Next**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/uVcOyTiHhKiPnDLwlKtM/assets/10.png)
{% endstep %}

{% step %}

## Mapping details

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/vl8LmexhtDA30MUhVVnb/assets/11.png)

| Field                 | What to enter                                                                                                                                     |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| Resource              | The system the users are being given access to. Required.                                                                                         |
| Privileged Account    | The account on that system the users will sign in as.                                                                                             |
| Status                | Whether the mapping is in effect. **Active** grants access immediately; set **Inactive** to create the mapping without enabling it yet.           |
| Requires Dual Control | Requires a second person's approval before these users can start a session on this resource. Turn this on for production and high-value systems.  |
| Valid From            | The date and time access begins. Leave blank for access that starts immediately.                                                                  |
| Valid To              | The date and time access automatically expires. Set this for contractors, vendors, or temporary project access; leave blank for permanent access. |

Select **Create**.
{% endstep %}
{% endstepper %}

Once the mapping is created, the user can reach that system from the Self Service Portal.

{% hint style="info" %}
Where a mapping requires dual control, the session request is routed for approval before it can start. Approvals are covered in *Approvals & Workflows*.
{% endhint %}

This is how access is granted in SECUREpass — to applications by role, to public applications by shared or individual credentials, and to systems by privileged account — with permanent grants for standing access and time-bound grants for everything that should expire on its own.