---
path: onboarding/manager-onboarding/access-management.mdx
title: Access management
sidebar_position: 4
slug: access-management
pagination_next: null
pagination_prev: null
description: >-
  How to invite team members to a Passwork vault, configure access levels per user or group,
  and manage permissions at vault and folder level.
keywords:
  - Passwork
  - access management
  - invite users
  - access levels
  - permissions
  - vault access
  - folder access
  - groups
  - read only
  - full access
---

## Invite users to a vault

To give a team member access to your department vault:

1. Open the vault in the navigation pane.
2. Click the **Vault control panel** — the user/group icon displayed under the vault name.
3. In the **Users** tab, click **Add user**.
4. Find the user by name or login and choose their access level.
5. Click **Save**.

<ImageComponent
  src="/img/assets/QKZtfOnnubSbfN3D1EPqb-wedpy5T0IfYtvaSLOMl6b-20250519-150525.png"
  alt="Vault access management — Users tab"
  format="regular"
/>

:::info Client-side encryption
If your organization uses client-side encryption, adding a new user generates an access request that must be confirmed in the **Requests** tab of the vault access panel before the user can see vault contents.
:::

## Access levels

Passwork uses five access levels for vaults and folders. Assign the minimum level required for each user's role.

| Access Level | View passwords | Copy to clipboard | Edit passwords | Delete passwords | Manage access |
|---|---|---|---|---|---|
| **Read Only** | Yes | Yes | No | No | No |
| **Read and Edit** | Yes | Yes | Yes | No | No |
| **Full Access** | Yes | Yes | Yes | Yes | No |
| **Administrator** | Yes | Yes | Yes | Yes | Yes |
| **Forbidden** | No | No | No | No | No |

**Forbidden** explicitly denies access to a vault or folder, overriding group-level permissions. Use it to restrict a specific user from a sub-folder within a vault they otherwise have access to.

## Grant access at folder level

Access can be configured independently for each folder within a vault. A user can have **Read only** access to the vault root while having **Full access** to a specific subfolder.

To configure folder-level access:

1. Open the folder in the content pane.
2. Click on the user count at the top to open the **Folder access** dashboard
3. Add users or groups and set their access level for this folder.

<ImageComponent
  src="/img/assets/folder-access.png"
  alt="Folder access view"
  format="regular"
/>

For full documentation, see [Folder access rights](https://passwork.pro/user-guides/vaults-and-folders/folder-actions/folder-access-rights/).

## Grant access via groups

If users are organized into LDAP groups or Passwork groups, you can grant vault access to an entire group at once. This is the recommended approach for large teams.

1. Open the vault access dashboard and go to the **Groups** tab.
2. Click **Add group**, select the group, and assign its access level.

<ImageComponent
  src="/img/assets/QKZtfOnnubSbfN3D1EPqb-Sz6b6FgpTGHqfKzsQoD74-20250519-152841.png"
  alt="Vault access management — Groups tab"
  format="regular"
/>

:::tip
When a new employee joins a group that already has vault access, they automatically inherit the group's permissions without needing individual configuration.
:::

## Review access at a glance

To see who has access to a vault, hover over the user/group icon to the right of the vault name in the navigation pane. This shows a quick summary of users and groups with their access levels.

<ImageComponent
  src="/img/assets/vaults-8.png"
  alt="Quick access view tooltip on vault"
  format="regular"
/>

## Next step

Proceed to [Password sharing](./password-sharing.mdx) to learn how to share individual credentials securely.