Skip to main content
Access requests add an approval step to sensitive accounts, such as a production database or a domain admin account. If an account requires approval, a member who already has access to it must request access and wait for an approver each time they need the account. The same rule applies to AI agents. An agent requests access as whoever started it, a person or a machine identity, and waits for an approver.

​
How approval works

Approval adds to the access that a member already has. To use an account that requires approval, a member needs both of the following:
  • A role on the account: The Admin, Operator, or Connector role on the account or its folder, which decides who can use the account at all
  • An approved request: A request that an approver has approved, which gives the member access for the duration they asked for
A member can only request access to an account they already have a role on. When the duration ends, the member loses access until they file another request.

​
Session and credential requests

Members request two kinds of access separately: An approved session request doesn’t reveal the credential, and an approved credential request doesn’t let the member launch a session. A member who needs both files two requests.

​
Set up approval

An account requires approval when its account template has Require Approval turned on. The approvers are set on the account’s folder, so a Product Admin and an Admin of the folder each do part of the setup.
1
As a Product Admin, go to Privileged Access Management > Account Templates, open the template for the account type, and turn on Require Approval.
2
As an Admin of the folder, add the account to the folder with that template. If the account already exists, a Product Admin must change its template instead.
3
Open the folder’s Approvals tab, add the users or groups who can approve requests under Approvers, and select Save Changes.
Approvers must already be members of the folder, which you add on the folder’s Permissions tab. An approver doesn’t need a role that lets them use the account. Only users and groups can be approvers. A machine identity can’t approve a request, even if it has the Admin role on the folder.
Members can’t request access to an account that requires approval until its folder has at least one approver.

​
Request access

On the Accounts page, an account that requires approval shows a key icon instead of the launch icon.
1
Select the key icon on the account’s row. To request the credential instead of a session, open the account’s menu and select Request Credentials.
2
Enter a Reason, which approvers see and the audit log records. The reason is required if the template has Require Reason turned on.
3
Choose how long you need access, from 15 minutes to 1 week, and select Request session access or Request credentials.
If the account can be auto-approved, the form also has optional fields for linking records, such as a Jira ticket. A request whose records pass one of the folder’s rules is approved as soon as you submit it. While the request waits for an approver, the account shows a clock icon. After an approver approves the request, the account shows the launch icon until the access expires. You can’t change the reason or the duration after you submit the request. To change either one, ask an approver to deny the request, then file a new one.

​
Review a request

When a member requests access, Infisical notifies the folder’s approvers by email and in Infisical.
1
Go to Privileged Access Management > Approval Requests and select the request.
2
Check the requester, the account, the reason, and the duration. If the request is for credential access, approving it lets the requester read the password or key outside a recorded session.
3
Optionally, enter an Approval comment for the requester, then select Approve or Deny.
One approval from any of the folder’s approvers is enough. You can’t approve a request that you filed yourself.

​
Request statuses

The duration starts when an approver approves the request, not when the member files it, so the member always gets the full duration they asked for. To see every request for a folder’s accounts, open the folder’s Approvals tab and go to Access Requests.

​
Revoke access

An Admin of the folder can end an approved request before its duration ends. On the folder’s Approvals tab, go to Access Requests and select Revoke access on the request’s row. If you revoke a session request, Infisical ends the member’s active sessions on the account immediately. If you revoke a credential request, the member can’t reveal the credential again, but a credential they already copied stays valid until you rotate the account.

​
Alerts

An alert notifies your team about access requests in a folder through email, Slack, a webhook, or PagerDuty. Each alert watches one of the following events: To add an alert, open the folder’s Approvals tab, select Alerts, and select Add Alert. A folder can have one alert for each event.
Slack, webhook, and PagerDuty channels need the Enterprise plan. Email channels are available on every plan.

​
Requests from AI agents

An AI agent requests access through the CLI. If the agent runs as you, the request is filed under your name. If the agent runs as a machine identity, the request shows the identity’s name. The first time an agent connects to an account that requires approval, the CLI files a request for the agent. After an approver approves the request, the agent’s next connection to the account works.
When you approve a request from an agent, you approve everything the agent does with the access for the duration you grant. Give an agent’s machine identity a role on only the accounts it needs, and review its session recordings.

​
Frequently asked questions

If the account is deleted, Infisical cancels the request.If the account moves to another folder, Infisical won’t approve the request, and the member can’t file a new one while it’s pending. An approver of the old folder must deny the old request first. The member can then file a new request, which goes to the approvers of the account’s current folder.
If you remove an approver, they can’t act on pending requests from that point on. If you add an approver, they can only act on requests filed after you added them. An approved request keeps its access until it expires or an Admin of the folder revokes it.

​
Next steps

Break-glass access

Let named responders grant themselves access in an emergency.

Account templates

Set the rules for connecting to the accounts that use a template.