diff --git a/docs/documentation/platform/access-controls/assume-privilege.mdx b/docs/documentation/platform/access-controls/assume-privilege.mdx new file mode 100644 index 000000000..407ee8b5d --- /dev/null +++ b/docs/documentation/platform/access-controls/assume-privilege.mdx @@ -0,0 +1,42 @@ +--- +title: "Assume Privileges" +description: "Learn how to assume privileges of a user or machine identities in a project." +--- + +## Overview + +The Assume Privileges feature allows authorized users to temporarily gain the permissions of another user or identity within the system. +This capability enables administrators to troubleshoot issues, perform maintenance tasks, or assist users without requiring permanent access to their accounts. + +## How It Works + +When an authorized user activates the Assume Privileges feature, they temporarily inherit the exact permissions of the target user or identity for a limited time period (1 hour). +During this period, they can perform actions within the system as if they had the same permission level as the target user. + +- **Permission-based**: Only transfers permissions, not the complete identity +- **Time-limited**: Access automatically expires after 1 hour +- **Audited**: All actions performed during the privilege assumption are logged under the original user's credentials +- **Authorization-required**: Only users with specific **assume privilege** permission can use this feature + +### Distinction from Impersonation + +Unlike impersonation, Assume Privileges: + +1. Does not change the user's display name or identity in the system +2. Records all actions under the original user's ID (not the target user) +3. Only provides access to permissions, not personal settings or data +4. Is designed for administrative and support purposes within proper authorization boundaries + +## Steps + +1. Navigate to Project Access and select a user/identity by clicking on their row in the table + ![Access control page](/images/platform/access-controls/assume-privileges/access-control.png) +2. Click the Assume Privilege button and type in assume to confirm and start your session + ![Access control detail page](/images/platform/access-controls/assume-privileges/access-control-detail.png) +3. A yellow alert session will appear showing your active assume privilege session; you can exit at any time by clicking the \*\*Exit button + ![session start](/images/platform/access-controls/assume-privileges/session-start.png) + + + The assume privilege session is scoped to a single project and will expire + after 1 hour. A user can only assume privileges for one project at a time. + diff --git a/docs/images/platform/access-controls/assume-privileges/access-control-detail.png b/docs/images/platform/access-controls/assume-privileges/access-control-detail.png new file mode 100644 index 000000000..e0844b8f4 Binary files /dev/null and b/docs/images/platform/access-controls/assume-privileges/access-control-detail.png differ diff --git a/docs/images/platform/access-controls/assume-privileges/access-control.png b/docs/images/platform/access-controls/assume-privileges/access-control.png new file mode 100644 index 000000000..aa6974cdd Binary files /dev/null and b/docs/images/platform/access-controls/assume-privileges/access-control.png differ diff --git a/docs/images/platform/access-controls/assume-privileges/session-start.png b/docs/images/platform/access-controls/assume-privileges/session-start.png new file mode 100644 index 000000000..1aab112c4 Binary files /dev/null and b/docs/images/platform/access-controls/assume-privileges/session-start.png differ diff --git a/docs/mint.json b/docs/mint.json index 69470e2b7..63eb41ddb 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -160,6 +160,7 @@ }, "documentation/platform/access-controls/additional-privileges", "documentation/platform/access-controls/temporary-access", + "documentation/platform/access-controls/assume-privilege", "documentation/platform/access-controls/access-requests", "documentation/platform/access-controls/project-access-requests", "documentation/platform/pr-workflows", @@ -887,8 +888,8 @@ ] }, { - "group": "LDAP Password", - "pages": [ + "group": "LDAP Password", + "pages": [ "api-reference/endpoints/secret-rotations/ldap-password/create", "api-reference/endpoints/secret-rotations/ldap-password/delete", "api-reference/endpoints/secret-rotations/ldap-password/get-by-id",