Access setup manages unlock methods, trust state, and team access readiness.
The navigation label is Access Setup, while the page itself is titled Access Management. It is the portal area for unlocking protected content, creating or reviewing access methods, setting up Team Access, and trusting the current browser with a PIN.
For background on why encryption keys are needed and how the privacy model works, see Security & Privacy Model.
Status Overview
At the top of the page, a status overview summarizes your current setup state.
The badges cover four areas:
| Badge | Typical states |
|---|---|
| Workspace | Select a workspace / Checking access / Access granted / Access blocked |
| Team Access | Select a workspace / Not set up / Locked / Unlocked |
| Personal Access | Sign in to check / Not set up / Locked / Unlocked |
| Setup | Sign in to check / Not set up / Setup needed / Setup complete |
A Next step message under the badges tells you what the portal expects you to do next.
Workspace, Team Access, Personal Access, and Setup state are summarized at the top of Access Setup.
Unlocking Access
When Personal Access or Team Access is locked, protected content stays hidden in the portal.
You can unlock from this page by opening the unlock flow and entering one of these methods:
- Access code
- Access password
- Browser PIN for this device, if one was previously saved
Unlocking Personal Access in the browser also enables related protected content on pages such as Timeline, Timesheets, and reporting flows.
Personal Access
Personal Access is your personal encryption key material.
If it has not been created yet, this page can guide you through creating it. Depending on your current state, the page may show:
- A Create Personal Access flow
- Combined setup when both personal and team access still need to be created
- Guidance about missing recovery methods or browser trust
Manage Team Access
Team Access is the workspace-level protected access layer used for workspace sharing scenarios.
Who can manage Team Access?
Creating or managing Team Access requires workspace configuration permission, which currently means admin or owner access for the selected workspace.
What this section does
The Manage Team Access section explains whether Team Access already exists and what should happen next.
Depending on your state, it can help you:
- Set up Personal Access first
- Create Team Access for the current workspace
- Understand that Team Access is waiting for an admin to enable it
This area is used to unlock protected content and move into the next required access step.
Member Access
When all of the following are true:
- you selected a workspace,
- you have workspace permission there, and
- Team Access already exists,
…the page shows a Member access section.
This section is used to issue individual access methods for the latest Team Access so members can unlock workspace-protected data independently.
Browser PIN storage and local trusted-device state are managed from this section.
Remember This Browser with a PIN
The PIN section is titled Remember this browser with a PIN.
It shows whether local PIN storage is available and whether this browser already has saved unlock material.
You can also see counts for:
- Personal access methods stored for this device
- Team access methods stored for this device
Forget this browser
Use Forget this browser to clear locally stored browser PIN data and related local device unlock material.
After that, you must unlock again with another access method.
If the browser does not support the required local storage features, the page explains that PIN storage is unavailable.
Access Method Details
The Access method details section is split into two expandable areas:
- Team access methods
- Personal access methods
Each saved access method is shown as a card rather than a simple table.
Typical details include:
- Access method type
- Key ID
- Creation time
- Rotation status
- Member user ID for team methods
Supported labels currently include:
- Access code
- Access password
- This device
- Passkey
- X25519 keypair
Saved team and personal access methods are listed here with their type, key, and rotation state.
Browser-session behavior
Unlocked access stays in browser memory for the current session. It is cleared when you log out, and workspace-specific protected access is also cleared when you switch workspaces.