Access control in Agent Vault happens at two levels:
- Product membership — being added to Agent Vault itself
- Access bundle grants — being granted an access bundle, which is what lets you create sessions with it
Users, groups, and machine identities all go through both levels and hold the same roles, so everything below applies to all three unless it says otherwise. An agent holds no access of its own: it runs on a session created by a person or a machine identity, and reaches only what that session’s access bundle covers.
Product membership
Agent Vault is organization-wide, so there is one membership list for the whole organization rather than one per project. There are two roles:
An admin reaches every access bundle without being granted one. A member reaches nothing until an admin grants them one, and sees only the ones they hold. Members see their own sessions; admins can switch the Sessions page between All Sessions and My Sessions.
Organization admins can enter Agent Vault as an admin themselves, without being added by someone else. Opening the product from the organization overview is enough.
Adding members
- Go to Agent Vault → Access Control
- Select the Users, Machine Identities, or Groups tab
- Select Add Users, Add Machine Identity, or Add Group
- Choose who to add, and give them Admin or Member
Whoever you add has to be an active member of the organization first. Invite them to the organization before adding them here.
You can’t change your own role or remove your own access. Ask another admin to do either.
Access bundle grants
Product membership is the entry ticket. Reaching a host still takes a grant on the access bundle that holds the service covering it.
Open an access bundle and select Manage Access to grant it to a user, machine identity, or group. The grantee has to be an Agent Vault member already.
Granting a group grants everyone in it, and each member creates sessions as themselves. Someone who joins the group later picks the grant up, and someone who leaves loses it.
When access changes
A change to membership or a grant reaches a running agent within one proxy poll, 60 seconds by default. Nothing on the agent’s machine needs restarting.
Removing someone from Agent Vault also takes away their access bundle grants, so adding them back leaves their sessions without credentials until you grant those again. See what a running agent can reach for what happens to each kind of change mid-run. 
