--- path: onboarding/admin-onboarding/phase-2-structure.mdx title: "Phase 2: Structure and roles" sidebar_label: "Phase 2: Structure & roles" sidebar_position: 3 slug: phase-2-structure pagination_next: null pagination_prev: null description: >- Passwork rollout Phase 2: creating vault types and the organizational vault structure, configuring custom roles and RBAC, assigning corporate owners and emergency access. keywords: - Passwork - vault types - company vault - roles - RBAC - role-based access control - custom roles - emergency access - vault structure - phase 2 --- --- **Estimated time:** ~2 hours **Responsible:** Project lead, Passwork administrator **Outcome:** Vault and folder structure reflects the organization's team structure; roles define what each user type can do. ## 2.1 Plan the organizational vault structure Before creating vaults in Passwork, map the organizational structure to a vault hierarchy. A well-designed structure reduces the amount of access management work throughout the lifecycle of the deployment. **Recommended approach:** - One vault per department or business unit - Subfolders for projects, environments, or service categories - Separate vaults for shared infrastructure credentials (e.g., `IT Infrastructure`) and executive or board-level credentials - A dedicated vault for external contractors with time-limited access **Access model overview:** ``` Organization ├── IT Infrastructure (vault) ← IT Admin team │ ├── Production Servers │ ├── Cloud Services │ └── Network Devices ├── Marketing (vault) ← Marketing team │ ├── Social Media │ └── Analytics Tools ├── Finance (vault) ← Finance team ├── HR Systems (vault) ← HR team └── External Contractors (vault) ← Project Lead + managers ``` This structure maps cleanly to LDAP groups: each Active Directory security group corresponds to a Passwork group, which is granted access to the corresponding vault. --- ## 2.2 Create vault types Passwork supports multiple vault types that control default behaviors and visibility rules. Vault types are configured by the system administrator. Navigate to **Settings and users → Vault management** to configure available vault types. Common vault types to configure: | Type | Use case | |------|----------| | **Private** | Personal vault — visible only to the owning user | | **Company** | Department or team vault — access managed by vault owner/admin | | **Shared** | Broad access vault for organization-wide credentials | Assign a **corporate administrator** to each Company vault. The corporate administrator has full administrative access to the vault and can grant emergency access to other administrators. --- ## 2.3 Configure custom roles Roles define what actions a user can perform in Passwork at the system level (creating vaults, inviting users, accessing settings). The default roles are **Owner**, **Admin**, and **User**. Create custom roles if your organization requires more granular permissions — for example, a **Help desk** role that can manage users but cannot modify system settings, or a **Auditor** role with read-only access to the activity log. ### Create a custom role 1. Go to **Settings and Users → Roles**. 2. Click **Create role**. 3. Enter a name for the new role. 4. Click **Save**. 5. Open the created role and configure the necessary permissions. For full role configuration documentation, see [Create role](https://passwork.pro/user-guides/user-management/roles/create-role/). --- ## 2.4 Define the RBAC structure Role-Based Access Control (RBAC) in Passwork combines system-level roles with vault/folder-level access levels. The resulting permission model works as follows: ``` User └── assigned System Role (what they can do in Settings) └── member of Group(s) (which vaults/folders they can see) └── Group → Vault access (Read Only / Read and Edit / Full Access / Admin) └── Folder overrides (more restrictive or more permissive per folder) ``` - Grant access primarily through **groups**, not individual users. This makes onboarding and offboarding faster. - Apply the **principle of least privilege**: start with Read only and elevate only when needed. - Use **Forbidden** access on sensitive subfolders to explicitly exclude users who inherit broader group access. - Assign the **Administrator** access level to the vault owner and one backup administrator only. --- ## 2.5 Configure emergency access Emergency access allows a designated Passwork administrator to access any Company vault in an emergency (e.g., when a vault owner is unavailable). Configure this before users start storing credentials. Navigate to the vault management page and assign an emergency access administrator. :::warning Emergency access should be granted to no more than one or two designated administrators. Document who holds emergency access and review the list periodically. ::: --- ## 2.6 Create an emergency service account For situations where the primary owner's account is inaccessible (lost credentials, departure, incapacitation), create a dedicated service account that acts as a corporate administrator on all vault types. **Setup procedure:** 1. Create a new Passwork user with the name `Service account` or similar that clearly identifies it as a system account. 2. Assign the administrator-level role to it. 3. Add the service account as a **corporate administrator** on all critical vault types (Settings → Vaults Settings → each vault type → Administrators). 4. **Block authentication** on the account: in the user's settings, disable all sign-in methods except one (e.g., local password). 5. Set a long, randomly generated password for the service account. 6. Write down the service account password and the master password (if client-side encryption is enabled) and store them on a physical medium — for example, a sealed envelope in the IT director's office safe or a fire-resistant document vault. 7. **Block the user account** in Passwork (Settings → Users → service account → Block) so it cannot be used for day-to-day sign-in. **When emergency access is needed:** 1. Retrieve the physical credentials. 2. Unblock the service account. 3. Sign in, access the required vault, perform the necessary actions. 4. Generate a new service account password. 5. Re-block the account and update the stored credentials. :::warning Log all emergency access usage in your organization's IT incident log. Emergency access bypasses the normal vault ownership model and must be audited. ::: --- ## 2.7 Client-side encryption (CSE) — decision guide Client-side encryption means that passwords are encrypted on the user's device before being sent to the server. The Passwork server never holds unencrypted credentials. Enabling CSE significantly raises the security baseline but has operational implications. | Factor | CSE Enabled | CSE Disabled | |--------|-------------|--------------| | **Data at rest on server** | Always encrypted | Encrypted at the database level only | | **Admin can see passwords** | No | Yes (with DB access) | | **User needs master password** | Yes — on every sign-in | No | | **master password forgotten** | All private data is lost | Not applicable | | **Vault sharing** | Requires cryptographic key exchange (request/approve flow) | Instant | | **LDAP sync auto-assignment** | Requires access request approval | Fully automatic | | **Performance** | Slightly higher client-side CPU on large vaults | Standard | | **Compliance** | Required for Zero-Knowledge deployments | Standard enterprise | Enable CSE if: - Your organization handles regulated data (medical, financial, legal) where Zero-Knowledge is a compliance requirement - Your threat model includes insider threats from system administrators with database access - Your organization's security policy mandates end-to-end encryption of credentials Do not enable CSE (or defer) if: - You have a large number of shared vaults with frequent membership changes — the request/approval flow adds operational overhead - Your help desk team is not prepared to handle master password reset requests (which result in permanent data loss for the affected user) - You are doing a proof-of-concept and want to evaluate the product without the operational complexity of CSE :::tip CSE can be enabled after initial deployment, but it requires a data migration step that migrates all existing vaults to the encrypted format. Plan accordingly — enable CSE either at the start, or after a defined period with a scheduled migration window. ::: See [Client-side encryption](https://passwork.pro/tech-guides/administration/client-side-encryption/client-side-encryption/) for the full configuration guide. --- ## Phase 2 completion criteria - [ ] Vault structure defined and reviewed with department managers - [ ] Corporate vaults created with appropriate names and types - [ ] Custom roles created for any non-standard permission requirements - [ ] Emergency access administrators assigned to all Corporate vaults - [ ] RBAC structure documented: which LDAP group maps to which vault and access level Proceed to [Phase 3: User rollout](./phase-3-rollout.mdx).