> For the complete documentation index, see [llms.txt](https://docs.valtimo.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.valtimo.nl/configuration-guides/access-control.md).

# Access control

Access control allows administrators to define roles and assign permissions that determine what users can see and do within the application.

This includes:

* [**Configurable elements**](/configuration-guides/access-control/configurable-elements.md) — Overview of resources and actions available for access control
* [**Roles**](/configuration-guides/access-control/roles.md) — Creating and managing roles
* [**Permissions**](/configuration-guides/access-control/permissions.md) — Granting permissions to roles
* [**Conditions**](/configuration-guides/access-control/conditions.md) — Restricting permissions with field and expression conditions
* [**Context conditions**](/configuration-guides/access-control/context-conditions.md) — Context-aware permission rules

***

## Accessing access control

{% stepper %}
{% step %}
Navigate to **Admin** in the sidebar
{% endstep %}

{% step %}
Click **Access Control**
{% endstep %}
{% endstepper %}

<figure><img src="https://3330064618-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq5dx9HWFJGshztp4binE%2Fuploads%2Fgit-blob-5a9f4180d9690d83f46a6189c0c38735588c5d7e%2F01-overview.png?alt=media" alt=""><figcaption><p>Access control overview</p></figcaption></figure>

{% hint style="info" %}
Roles configured here apply platform-wide and affect all users with the corresponding role assignment in Keycloak.
{% endhint %}

***

## How access control works

Valtimo uses permission-based access control (PBAC). Each role can have multiple permissions that grant access to specific resources (such as cases, tasks, or documents) and actions (such as view, create, modify, or delete).

Permissions can be further refined using:

* **Conditions** — Restrict access based on field values (e.g., only cases with a specific status)
* **Context conditions** — Restrict access based on related resources (e.g., processes can only be started within the context of an active loan request case)

***

## Export

Roles and their permissions can be exported as JSON files for backup or migration purposes. Select one or more roles and click **Export** to download the configuration.