> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/assurance/access.md).

# Access

**Open this area:** In the CORTEX menu, select **People & settings → Users and access**.

Distinguish creating an account, granting an operation and admitting a person to a protected workspace.

**Who uses this:** Administrator, Requirement owner.\
**Open in CORTEX:** `/administration/access`.\
**In-app guide:** `/help?topic=access`.

**Expected result:** An explicitly authorised access decision is saved with its scope, finite expiry and reason.

## Before you start

* Hold the explicit authority for the change: global access management for grants, or current Manager membership for that workspace.
* Obtain the accountable owner's approved scope, handling, permissions and expiry.
* Check the intended person's exact organisation account; an account alone has no intelligence-content access.

## What to do

{% stepper %}
{% step %}

## Find or create the account

Use Search users in Access administration. Results are access-scoped and shown 25 at a time; submit a search before moving between pages.

The pager states the exact visible range and explains when a reduced result total leaves a later page unavailable, so you can return with Previous. Paging reads accounts without changing identities or grants.

A current Foundry administrator role is required to create a local account. The compact form marks email, initial password and audit reason as required and lists missing or invalid inputs immediately. Foundry checks its current password policy at submission.

Select Create account without data access and arrange credentials through the approved organisational channel.
{% endstep %}

{% step %}

## Prepare a bounded grant

Open the account's access editor. Review the described permissions and any workflow profile as a draft, then set only the approved operations, handling scope and validity.

A profile selection is not a saved grant.
{% endstep %}

{% step %}

## Record the global decision

Supply the reason and select Save audited access revision.

On a conflict, use Reload current grant and reassess the proposed changes; do not overwrite a newer decision blindly.
{% endstep %}

{% step %}

## Manage the workspace separately

In Workspaces, open Manage workspace for the intended purpose. Use Find accounts for an eligible organisation account or Edit member for an existing member.

Set role, finite expiry, Membership enabled and reason, then Save membership.
{% endstep %}

{% step %}

## Verify the effective result

Confirm the retained revision and membership status.

Effective content authority is the intersection of the global grant, workspace role and handling, so a Reader role can still narrow a broad grant.
{% endstep %}
{% endstepper %}

## Check the result

* Is the recipient the correct active organisation account?
* Are permissions and full handling no broader than the approved need?
* Is the expiry finite and appropriate?
* Will an active workspace Manager remain?
* Did both the intended grant and membership changes save?

## If you get stuck

<details>

<summary>Why did a user-results page become unavailable?</summary>

The authorised total can change after a submitted search or another access decision. CORTEX explains when the requested page is beyond the new last page; select Previous to return to available results.

A draft search that has not been submitted does not change the pages you are browsing.

</details>

<details>

<summary>Why can a new account sign in but see no content?</summary>

Check both its enabled, unexpired global grant and membership of the selected workspace. Creating the account intentionally supplies neither missing data permission nor implicit workspace entry.

</details>

<details>

<summary>Why is the intended member absent from search?</summary>

Check the exact email, active identity, global handling and current grant. Refine the bounded search; ask the proper grantor to resolve ineligibility rather than granting a broader workspace role.

</details>

<details>

<summary>Why can I not disable myself or the last Manager?</summary>

Arrange for another eligible active Manager to maintain continuity and perform the authorised change. The interface protects against self-disable and removal of the last active Manager.

</details>

## Responsibility and limits

* Verify the human authority behind delegation; software roles are not evidence of appointment or vetting.
* An administrator does not gain content access by managing accounts. Revocation cannot recall an already downloaded file or undo an already completed operation.

**Reference and scope:** JDP 2-00 (4th ed.), 4.27–4.35, 6.3 and 6.30 inform need-to-know and accountable access. CORTEX profiles prepare grants; they do not confer appointments or clearance.

**Related workflows:** [Start in the right workspace](/getting-started/choose-a-workspace.md); [Record authority before new source use](/sources-and-evidence/source-authority.md); [Review, approve and publish an exact internal release](/workflow-guides/products/release.md); [Use and customise the Demo organisation](/getting-started/training-and-demos/demo-accounts.md).