An access right is the ability to see certain system objects and perform allowed actions with them. Users may have access rights to the following macro-objects of the system:

• accounts and resources;
• users;
• units;
• unit groups.

Access rights may be granted to the users of all types of accounts and at any level of the hierarchy. As a rule, a higher-level user gives access rights to a lower-level one. 

The Access tab of the object properties is used to grant and restrict access rights.

This tab can also be used to see what access right presets are already assigned to an object.

Granting access rights

You can grant access rights to a unit, unit group, or resource (account) either in the properties of this object or in the properties of the user to whom access is given. Access rights to users can be granted to a user only in the user properties. These two methods and the particularities of granting rights are described below.

Granting access rights from user properties

You can use this method if you want a user to receive access rights to several objects of one type at the same time. Besides, this is the only way to grant them access rights to other users.

To grant access rights from the user properties, follow the steps below.

1. Open the Access tab in the properties of the user who should get access rights to the object.
2. Select the type of object to which the user should get access: units, unit groups, users, resources.

3. Find the objects you want to grant access to. To do this, you can use dynamic search by the object name. Depending on the type of object, you can use other search criteria: by creator, account to which the object belongs, unit group, unique ID. The list of these criteria is above the search field. Also, using the icons and, you can sort the objects in the list by access rights or alphabetically, respectively.

   If the list contains more than 1000 objects, you can sort them only alphabetically.

4. In the list, select the object to which the user should get access. 

   The list displays only the objects to which you have the Full Access preset.

   Select several objects holding down the Ctrl or Shift key to give the user the same access rights to them.

5. Select one of the three available access right presets.
6. Save the changes.

Granting access rights from object properties

You can use this method if you want several users to get access rights to the same object.

To grant access rights from the object properties, follow the steps below.

1. Open the Access tab in the properties of the object to which the users should get access.
2. Find the users you want to grant access to. To do this, you can use the dynamic filter by the user name, their creator or the account to which they belong. Using the icons and, you can sort the users in the list by access rights or alphabetically, respectively.

3. Select one or several users who should get access to the object. 

   The list displays only the users to whom you have the Full access preset. 

   Hold down the Ctrl or Shift key to select several users at a time and give the same access rights to them.

4. Select one of the three available access right presets.
5. Save the changes.

Particularities of granting access rights

When granting access rights, consider the following hierarchy rules:

• The creator has all the access rights to the object. They can be limited only by a user of a higher-level account.
• You can’t grant more access rights to a user than the creator of this user has to the same object.
• A user can transfer rights to other users only if they have Full access to the object.

If a user has Full access preset to a unit group, you can’t deprive them of rights to a unit belonging to this group until this unit is removed from the group.