> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> The layers that decide who can use which connected account — and what the agent is allowed to touch.

Nuphos controls access in three layers. Together they answer: *who is this
person, which accounts may they use, and what can the agent do right now?*

## 1. Team roles

Every member has a [role](/collaboration/teams) — **Administrator**, **Editor**,
or **Viewer** — that sets their baseline. Only Administrators can connect or
remove accounts and manage members.

## 2. Member allow-lists on a binding

When an account is connected, an Administrator can restrict it to **specific team
members** with a per-binding allow-list. By default, binding an account grants
access to the person who connected it; the allow-list is how you widen or narrow
that.

This is enforced on **every** credential request: even if the agent has an account
selected, Nuphos re-checks that the requesting user is allowed to use it before
handing over credentials.

<Tip>
  Use allow-lists to keep production accounts to a small group while letting the
  whole team work with staging.
</Tip>

## 3. Per-session credential selection

Within a session, the agent only ever has the credentials **you explicitly
selected** for that session — and only for accounts you're allowed to use. The
agent can't reach into an account you didn't hand it. See
[Agent sessions](/agent/sessions).

## Why this matters

These layers compose into least-privilege by default: a Viewer can't change
anything, a member can only use the accounts they're on the allow-list for, and
each session is scoped to exactly the credentials it needs. The credentials
themselves are short-lived — see the [IAM trust model](/security/iam-trust).

For control over *changes* specifically — approvals and audit — see
[Approvals & audit](/security/approvals).