Access and grants
Who may do what on a server, as which OS identity, and until when.
Fleet → Access controls what people may do through the agent. It is separate from the AccelerUp role model on purpose.
Being an admin in AccelerUp does not give you a shell on a server. The
blast radius of "can edit a dashboard" and "can run a command as root on
production" should not be the same permission.
A grant
| Property | Meaning |
|---|---|
| Who | A user or a team |
| Where | A server, a tag, or an environment |
| What | Terminal, commands, file transfer |
| As | An OS identity — root or a named user |
| Until | An expiry. Required |
The OS identity
A grant names the identity the work runs as. It is resolved by the agent and capped by the machine: a grant naming an identity the machine will not accept is refused there, not honoured.
This means the machine remains the final authority over what happens on it, which is the same principle as the profile.
Expiry is not optional
Every grant expires. Standing access to production is how an account compromise becomes a production compromise.
A terminal session dies when its grant expires — immediately, not at the next reconnect. A shell that outlives its authorisation is the whole problem this model exists to prevent.
The three tabs
| Tab | Shows |
|---|---|
| Rules | The policy — who may request what |
| Who has what | Currently active grants, with expiries |
| History | Every grant ever issued, used or expired |
"Who has what" is the one to check before an audit, and after somebody leaves.
Requesting
A grant can be requested and approved, rather than handed out in advance. The request names what is needed and why; the approval is audited.
This is the right default for production: access at the moment of need, with a record of why.
Capped by profile
The profile is the outer boundary. A grant for terminal
access on an observe machine grants nothing — the machine will not accept the
session.
The page says this rather than leaving you to discover it when the button does nothing.
Audit
Every grant, use and expiry is in the audit log, and terminal sessions are recorded. Local secrets are redacted unconditionally, including in transcripts.
Where this behaviour lives: backend/internal/domain/agent_access.go, frontend/src/app/agents/access/. If the code and this page disagree, the code is right — please fix the page.
Part of Fleet — The agent on each server: what it collects and what it may be asked to do.