> For the complete documentation index, see [llms.txt](https://wiki.datadike.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.datadike.com/en/administration/access/authorizations.md).

# Authorizations

## What this is and when to use it

An authorization is the only thing that grants access. Without one, a user who can log in to the console still sees no assets and can open no sessions.

Each rule joins three sides:

| Side     | What you choose                                                                 |
| -------- | ------------------------------------------------------------------------------- |
| **Who**  | Users, groups, or both                                                          |
| **What** | Assets, folders, and which accounts on them                                     |
| **How**  | Protocols, permitted actions, validity period, and whether approval is required |

Create one whenever a person or team needs access to a set of assets. Prefer a few rules aimed at groups and folders over many rules aimed at individuals — they are far easier to audit.

## Before you start

* The **SYSADMIN** profile.
* The assets already registered, and the accounts you intend to grant.
* The users or groups that will receive access.

## Steps

1. Open **Policies › Authorization**. The left pane is the asset folder tree; selecting a folder filters the rule list on the right to rules that touch it.
2. Click **Create**.
3. Give the rule a **name** that says who gets what — the name is what an auditor reads first.
4. Choose the subject under **Users** and **Groups**. Either may be left empty, but not both.
5. Choose the target under **Assets** and **Nodes**. Individual assets, whole folders, or a combination.
6. Choose which **accounts** the rule grants:
   * **All existing accounts** — every account on the asset
   * **Specified accounts** — a named list
   * **Virtual accounts** — the credential is not stored:
     * **Manual account** — the user types username and password at connection time
     * **Same account** — the solution uses the user's own PAM account name. If that account exists on the asset the login is automatic; otherwise the username is filled in and the user supplies the password
     * **Anonymous account** — no credential at all, for web and custom assets
7. Choose the **protocols**: all, or a specific list.
8. Choose the permitted **actions** — see the field reference below.
9. Set the **validity period**. Start and expiry are both timestamps.
10. Decide whether the access requires **approval**, and how many approvers.
11. Click **Submit**.

## What you should see

The new rule appears in the list on the right, with the **Valid** column showing whether it is currently in force. A rule can be saved and still be invalid — because it is inactive, or outside its validity period.

## How to verify it worked

Do not trust the rule list. Verify from the user's side:

1. Sign in as one of the users the rule covers, or ask them to.
2. The granted assets must appear in their asset list. If they do not, the rule is not reaching that user.
3. Open a session to one of the assets, over one of the granted protocols.
4. Confirm the session appears under **Audit › Sessions**.

If the assets appear but the session fails, the problem is usually the protocol list or the account selection, not the rule's subject.

## Common errors

| Symptom                                      | Cause                                                    | Fix                                                                         |
| -------------------------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------------- |
| The rule exists but grants nothing           | Inactive, or outside the validity period                 | Check the **Valid** column, then the start and expiry dates                 |
| The user sees no assets                      | The user is in neither the user list nor a granted group | Add the user or their group to the rule                                     |
| The asset appears but the session is refused | The protocol is not in the rule's protocol list          | Add the protocol, or switch the rule to all protocols                       |
| File transfer is blocked mid-session         | The **Transfer** actions were not granted                | Grant upload, download, or delete as needed                                 |
| A user has more access than expected         | Two rules cover the same asset                           | When rules overlap, **the least restrictive one wins**. Find the other rule |
| A session ends on its own                    | The authorization expired while the session was open     | Active sessions are terminated automatically when the rule expires          |

## Field reference

### Accounts

| Option                | What it does                                               |
| --------------------- | ---------------------------------------------------------- |
| All existing accounts | Grants every account registered on the asset               |
| Specified accounts    | Grants a named list                                        |
| Manual account        | No stored credential; the user types username and password |
| Same account          | Uses the user's own PAM account name on the target         |
| Anonymous account     | No credential; web and custom assets only                  |

### Protocols

| Category      | Protocols                                                 |
| ------------- | --------------------------------------------------------- |
| Remote access | SSH, SFTP, RDP, VNC, Telnet, WinRM                        |
| Databases     | MySQL, MariaDB, PostgreSQL, Oracle, SQLServer, DB2        |
| Specialized   | Redis, K8s, HTTP(S), ChatGPT, Dameng, ClickHouse, MongoDB |

### Actions

| Action              | What it permits                                     |
| ------------------- | --------------------------------------------------- |
| Connect             | Opening a session. Without it, nothing else applies |
| Transfer › Upload   | Sending files to the asset                          |
| Transfer › Download | Retrieving files from the asset                     |
| Transfer › Delete   | Deleting files on the asset                         |
| Clipboard › Copy    | Copying from the session to the local clipboard     |
| Clipboard › Paste   | Pasting from the local clipboard into the session   |
| Share               | Sharing the live session with another user          |
| All                 | Every action above                                  |

### Validity and approval

| Field                     | What it does                                                                                                             |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Active                    | Turns the rule on or off without deleting it                                                                             |
| Date start / Date expired | The window in which the rule is in force. Sessions running when the rule expires are terminated                          |
| Approval                  | Whether access requires approval before it is released, and how many approvers. Two or more approvers gives dual custody |

## Related pages

* [Core concepts](/en/get-started/core-concepts.md) — how authorizations relate to accounts, assets, and profiles
* [Approval workflows](/en/administration/access/approvals.md)
* [Just-in-time access](/en/administration/access/just-in-time.md) — access granted on demand instead of standing
* [Command inspection](/en/administration/access/command-filtering.md) — restricting what may be run inside a granted session