> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> Understand how permissions work in Agent Vault.

Access control in Agent Vault happens at two levels:

1. **Product membership** — being added to Agent Vault itself
2. **Access bundle grants** — being granted an access bundle, which is what lets you create sessions with it

Users, groups, and [machine identities](/docs/documentation/platform/identities/machine-identities) all go through both levels and hold the same roles, so everything below applies to all three unless it says otherwise. An agent holds no access of its own: it runs on a session created by a person or a machine identity, and reaches only what that session's access bundle covers.

## Product membership

Agent Vault is organization-wide, so there is one membership list for the whole organization rather than one per project. There are two roles:

| Role       | What they can do                                                                                                  |
| ---------- | ----------------------------------------------------------------------------------------------------------------- |
| **Admin**  | Create and manage access bundles, services, and proxies. Grant access bundles. Manage membership. Read audit logs |
| **Member** | Create sessions with the access bundles granted to them, and revoke their own                                     |

An admin reaches every access bundle without being granted one. A member reaches nothing until an admin grants them one, and sees only the ones they hold. Members see their own sessions; admins can switch the Sessions page between **All Sessions** and **My Sessions**.

<Note>
  Organization admins can enter Agent Vault as an admin themselves, without being added by someone else. Opening the product from the organization overview is enough.
</Note>

### Adding members

1. Go to **Agent Vault → Access Control**
2. Select the **Users**, **Machine Identities**, or **Groups** tab
3. Select **Add Users**, **Add Machine Identity**, or **Add Group**
4. Choose who to add, and give them **Admin** or **Member**

Whoever you add has to be an active member of the organization first. Invite them to the organization before adding them here.

You can't change your own role or remove your own access. Ask another admin to do either.

## Access bundle grants

Product membership is the entry ticket. Reaching a host still takes a grant on the [access bundle](/docs/documentation/platform/agent-vault/access-bundles) that holds the service covering it.

Open an access bundle and select **Manage Access** to grant it to a user, machine identity, or group. The grantee has to be an Agent Vault member already.

Granting a group grants everyone in it, and each member creates sessions as themselves. Someone who joins the group later picks the grant up, and someone who leaves loses it.

## When access changes

A change to membership or a grant reaches a running agent within one proxy poll, 60 seconds by default. Nothing on the agent's machine needs restarting.

Removing someone from Agent Vault also takes away their access bundle grants, so adding them back leaves their sessions without credentials until you grant those again. See [what a running agent can reach](/docs/documentation/platform/agent-vault/sessions#what-a-running-agent-can-reach) for what happens to each kind of change mid-run.