Access

Manage Control users, roles, MFA, sessions and API tokens.

Use Access for identities that can sign in to or call Control.

In this section

Users and rolesCreate Control users and assign the minimum role they need.MFA and account recoveryEnable TOTP MFA, store recovery codes and recover an Administrator when normal sign-in is unavailable.API tokens and sessionsCreate scoped API tokens and review active browser sessions.

Control has three user roles:

Administrator — full Control administration, including identity and sensitive configuration. Administrator browser sessions can also open the root host terminal.
Operator — day-to-day supported operations without identity administration or host-terminal access.
Read only — inventory and read surfaces only.

Use MFA for interactive Administrator accounts. Use API tokens for integrations that need supported API access rather than sharing a person's password. API tokens cannot open or operate host-terminal sessions.

Current SSH and SFTP sessions

Administrators can review authenticated host access sessions from Security → Access. The list shows the authenticated account, source and local address, connection age and whether the session is ordinary SSH or a Control-managed Site SFTP session.

When the authenticated Unix account belongs to a managed Site, Control correlates the connection to that Site and labels it SFTP. Other authenticated OpenSSH connections remain labelled SSH. Pre-authentication sockets are not shown.

This view is read-only. Control does not expose arbitrary process command lines or environment variables through the session inventory, and API tokens cannot enumerate host access sessions.