---
title: Adding Permissions to Password Vault Accounts
slug: getting-started-guide-legacy-ui/adding-permissions-to-password-vault-accounts
description: Learn how to set authorization levels for SAPM accounts and grant permission rights to users. Understand the various types of permissions, such as READ_ONLY, FULL_CONTROL, READ_ONLY_FIRST_PART, and READ_ONLY_SECOND_PART, and their implications. Discover h
docTags:
createdAt: 2022-08-04T13:10:29.000Z
---
You can define different authorization levels for the SAPM accounts. SAPM accounts are created by admins, but they are used by other users.
To give permission rights to these users:
1. Navigate to **SAPM Management >** **SAPM Management.**
2. Open the **SAPM Accounts **tab.
3. Search and select the account to give permissions to, click the **Options **button and then the **Permissions** button.
4. Select the user group, permission, and **Save**.
| **Types** | **Description** |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **READ\_ONLY** | These users only have the authority to see the dynamic password. |
| **FULL\_CONTROL**
| Users who have full control permission are admins of Password Vault accounts. These users have full authority, such as resetting, changing the password, and giving permissions to users. |
| **READ\_ONLY\_FIRST\_PART**
| These users only have the authority to see the first half of the dynamic password. |
| **READ\_ONLY\_SECOND\_PART** | These users only have the authority to see the second half of the dynamic password. |
:::hint{type="info"}
One user can be a member of multiple user groups with different rights. In this case, the permission order is as follows:
FULL\_CONTROL > READ\_ONLY > READ\_ONLY\_FIRST\_PART > READ\_ONLY\_SECOND\_PART
It means that if a user has FULL\_CONTROL and READ\_ONLY rights, they will have the FULL\_CONTROL right, which is superior. If they have the READ\_ONLY\_FIRST\_PART and READ\_ONLY\_SECOND\_PART rights, they will get the first part of the password.
:::
