Skip to main content
Some accounts are sensitive enough that simply having access to them shouldn’t be enough to use them. A production database or a domain admin account should be reachable only by people who are already trusted, but even for them, each individual use should clear an extra checkpoint. Access requests add that checkpoint: before a member can launch a session on a gated account, their access has to be approved. The template’s Require Approval policy gates two things, and each is requested separately: launching a session, and viewing the account’s credentials. Everything below applies to both. An approved session request never reveals the credential, and an approved credential request never launches a session, so a member who needs both files both. The same checkpoint applies to AI agents. An agent requests access as whoever started it, a person or a machine identity, and waits for an approver either way.

​
How it works

Approval sits on top of the access a member already holds. Two layers apply to a gated account:
  • Membership grants use access, the right to launch a session and connect to the account. This comes from the Admin, Operator, or Connector role on the folder or account, and it’s the record of who can ever get in. Credential access needs the Operator or Admin role specifically.
  • Approval decides whether a member is cleared to use that access right now.
A gated account needs both. A member requests access on an account they can already use, an approver signs off, and the member’s access opens for the duration they asked for. When the duration runs out, the access closes again.
A member can only request access on an account where they already hold use access. If they can’t already launch a session on the account, there is nothing for them to request.

​
How an account becomes gated

Whether an account is gated comes down to the template it uses.
  • The Product Admin builds the templates and turns on Require Approval for the ones meant to be secure.
  • The Folder Admin gates an account by onboarding it with one of those templates. The account inherits the requirement from its template.
  • The Folder Admin then seats the approvers on the folder’s Approvals tab, since the template says approval is required but not who gives it.

​
Setting up an access gate

1

Prepare a secure template (Product Admin)

Go to Privileged Access Management → Account Templates, open (or create) a template for the account type, and turn on Require Approval.See Account Templates for the full list of template settings.
2

Onboard the account with that template (Folder Admin)

When you add the account to your folder, choose the template that requires approval. The account is now gated.
3

Seat approvers in the folder (Folder Admin)

Open the folder and go to its Approvals tab. Add the users or groups who can approve requests for the folder’s gated accounts.Approvers must be members of the folder, so the picker only offers people who already belong to it. An approver does not need use access to the account: approving is a governance action, not an access action.Only users and groups can be seated. Approving is a human sign-off, so a machine identity is never an approver, even one with Admin on the folder.
A gated account with no approvers seated has no one who can clear its requests, so it stays locked until a Folder Admin adds approvers on the folder’s Approvals tab.

​
Requesting and granting access

​
Filing a request

From the Accounts page, a member sees every account they can reach. Gated accounts show a key icon instead of the rocket (launch) button — select the key or select Request Access from the menu to start a request. To request, the member provides a reason and a duration, both fixed at submission. The account then shows Pending Approval until it clears. Once approved, the key icon switches to the rocket icon and the member can launch sessions until the grant expires.

​
Reviewing a request

Approvers are notified by email and in the app when a request needs them. From Approval Requests, an approver sees the requests waiting on them, each showing the requester, account, folder, reason, and duration. A credential request carries a Credentials badge, so an approver can tell at a glance that approving hands over the raw password rather than opening a recorded session. They approve or reject the request. A single approval from any one of the folder’s seated approvers clears it; it doesn’t have to come from a specific person.

​
The request lifecycle

Every request carries the reason and duration set by the requester and moves through a small set of states. Rejected, expired, and revoked requests stay in the list so the audit trail stays complete.

​
Requests from AI agents

An agent requests access on the same terms as a person, but from the CLI instead of the dashboard. A request from an agent running as a machine identity shows the identity’s name in place of a requester’s email; one from an agent you started yourself is filed under your own name. When an agent reaches for a gated account, the request is filed for it automatically, and the account starts working on the agent’s next attempt after you approve.
Approving a request from an agent’s identity means approving whatever that agent does with the access for the duration you grant. Keep those identities scoped to the accounts they need, and review the session recordings.

​
Frequently asked questions

At approval. The countdown begins the moment access becomes active, not when the request was filed, so the requester gets the full duration they asked for regardless of how long approval took. A four-hour request that sits pending for three hours still grants four hours of access once it clears. Time spent waiting on approvers never eats into the granted duration.
No. An approver who files a request can’t approve it. That separation of duties stops any one person from clearing their own access.
No. The reason and duration are fixed by the requester when they file, and an approver can only approve or reject. If the duration looks wrong, the approver rejects the request and the requester files a new one. What gets approved is always exactly what was requested.
No. An approver has to be a member of the folder, but approving is a governance action rather than an access action, so they don’t need to be able to use the gated account themselves.
A Folder Admin. Revoking ends an active request right away and cuts off access before its duration runs out. Any active session using that access is terminated immediately.Revoking a credential request is weaker: it stops further reveals, but a credential already copied is outside Infisical and stays valid until the account is rotated. It also leaves live sessions alone, since those are authorized by their own grant.
Removing an approver takes effect right away: someone dropped from the folder’s approvers can no longer act on a request that is still pending. Adding an approver doesn’t reach back into requests already in flight, so a pending request can only be cleared by the approvers it had when it was created. An approved request is already granted and keeps its access until it expires or is revoked, whatever changes afterward.

​
Next steps

Account Templates

Turn on Require Approval for sensitive account types.

Folders

Seat approvers on the folder’s Approvals tab.

Access Control

Understand the roles that grant use access in the first place.

Accounts

Add the databases and servers you want to gate.