> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/configuration/admin-entitlements.md).

# Admin entitlements

Administering identity should not require the ability to do everything. A help desk agent resetting passwords does not need to change security policy; an auditor needs to read the audit trail without being able to alter it.

An **entitlement** is how that is expressed: a named set of console permissions, attached to a role. Anyone holding the role gets exactly those permissions and nothing else.

Select **Configuration → Admin Entitlements**.

![The entitlements list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/AyN4HIYXUYpC62Pr4Ajk/assets/01.png)

| Column                   | What it shows                                       |
| ------------------------ | --------------------------------------------------- |
| Role Name                | The role the entitlement is attached to             |
| Entitlement Name         | The name given to this set of permissions           |
| Entitlements             | The permissions it grants, with a count of the rest |
| Created By / Modified By | Who defined it and who last changed it              |
| Status                   | Whether it is in effect                             |
| Actions                  | View, edit and delete                               |

Some rows are marked **Default**. These ship with the platform, and they offer only the view action — they can be read but not edited or deleted. Build your own entitlements rather than trying to reshape those.

## Creating an entitlement

Select **Create Entitlement**.

![Creating an entitlement.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/dJSXKrGwvtWmiIjHWKmp/assets/02.png)

Give it a **name**, choose the **role** it attaches to, then tick the areas of the console it may reach:

**Access Management · Users & Groups · Resources · Schedulers · Integrations · Approvals · Configuration · Reports**

Each area expands with the **+** beside it, so permissions can be granted at a finer level than the whole area — a role that may read users without creating them, for instance.

Select **Create Entitlement** to save.

{% hint style="info" %}
**Note**

Grant the narrowest set that lets the person do their job. It is easy to tick every box to stop someone asking again, and doing so quietly recreates the problem entitlements exist to solve — an administrator who can do anything is an administrator whose mistakes can affect anything.
{% endhint %}

## Viewing, editing and deleting

**View** opens the entitlement read-only, which is the safe way to check what a role actually grants before assigning it to someone.

**Edit** reopens it for changes.

![Editing an entitlement.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/nEVi0vWJJM0wAG5aZLgg/assets/03.png)

The role and the permission tree can both be changed, and the change applies to everyone holding that role — including administrators currently signed in.

**Delete** removes it, after confirmation.

{% hint style="warning" %}
**Caution**

Deleting an entitlement cannot be undone, and everyone holding the role loses those permissions immediately. Check who holds the role before deleting — an administrator who loses access mid-task will not be told why.
{% endhint %}