---
title: Adding Permissions to Password Vault Accounts
slug: kronpam-getting-started-guide/adding-permissions-to-password-vault-accounts
description: Learn how to assign different authorization levels to users in a Password Vault Account with our step-by-step guide. Discover the various levels, such as READ_ONLY and FULL_CONTROL, and how to assign users to multiple user groups. Find out how permission 
docTags: 
createdAt: 2023-09-08T14:19:23.743Z
---

*While creating a Password Vault Account, you can define various authorization levels for those accounts. While admins create Password Vault accounts, these are utilized by other users. To grant permission rights to these users, you can configure their access levels accordingly.*

Once you have created your Password Vault Account, click the "Options" button located near it. This action will open a pop-up window where you should select the "Permissions" option under the Account section. From there, you can assign permission levels to individual users or user groups as needed.

| **Types**                    | **Description**                                                                                                                                                                            |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **READ\_ONLY**               | These users only have the authority to see the dynamic password.                                                                                                                           |
| **FULL\_CONTROL**            | Users who have full control permission are admins of Password Vault accounts. These users have full authority, such as resetting, changing the password, and giving permissions to users.  |
| **READ\_ONLY\_FIRST\_PART**  | These users only have the authority to see the first half of the dynamic password.                                                                                                         |
| **READ\_ONLY\_SECOND\_PART** | These users only have the authority to see the second half of the dynamic password.                                                                                                        |

:::hint{type="info"}
One user can be a member of multiple user groups with different rights. In this case, the permission order is as follows:

FULL\_CONTROL > READ\_ONLY > READ\_ONLY\_FIRST\_PART > READ\_ONLY\_SECOND\_PART

This means that if a user has FULL\_CONTROL and READ\_ONLY rights, they will have the FULL\_CONTROL right, which is superior. If they have the READ\_ONLY\_FIRST\_PART and READ\_ONLY\_SECOND\_PART rights, they will get the first part of the password.
:::

![1](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/bbaitNaH5O-SCYwXw6OBv_image.png "Permission option in the Password Vault Account Actions")

![2](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/5QGD72rX-nyz4RxNcxkrA_image.png "Permission option in the Password Vault Account Actions")

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/GMAMmcga6SKtXvsBcsd18_image.png" size="64" width="550" height="517" position="center" caption="Adding Permissions to Password Vault Accounts" showCaption="true"}