--- title: "Self-service requests" slug: "self-service-about" updated: 2026-11-06T17:24:58Z published: 2026-11-06T17:24:58Z canonical: "docs.senhasegura.io/self-service-about" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Self-service requests Self-service lets users request privileged access for themselves in Segura™. Users can request a role, membership in an access policy, a domain credential, or an Active Directory account. Each request carries a justification and goes to the approvers for that request type. Segura™ records every request, decision, and approver in one place. Administrators turn Self-service on and choose which request types users see. Users then work from the Self-service panel. More information in [Configure Self-service](/v4-2/docs/self-service-how-to-configure). ## Key concepts - **Requester**: the user who opens a request and writes the justification. - **Approver**: the user who approves or rejects a request. The approver depends on the request type. - **Global approvers**: users that an administrator adds to the **List of global approvers** in the Self-service settings. They approve role requests and access policy requests, except requests for a PAM Core access policy in the static model. - **Policy administrators**: users who administer a PAM Core access policy in the static access policy model. They approve requests that involve their policy. - **Expiration time**: how long a request can wait for a decision. A request that reaches it expires and can no longer be approved. ## How it works A request moves through four stages: 1. The requester opens a card on the Self-service panel, fills in the request, and writes a justification. 2. Segura assigns the approvers and notifies each of them by email. 3. An approver approves or rejects the request. The requester can cancel it while it is still pending. 4. After approval, Segura grants the requested access and notifies the requester. Two request types are approved automatically, so Segura runs them as soon as the requester submits them: **Credential request** and **AD Account Provisioning**. When a request has more than one approver, one decision is enough. The first approval grants the access, and the first rejection closes the request. Self-service does not use approval levels. By default, users cannot approve their own requests. Segura removes the requester from the approvers. For this reason, Segura refuses an access policy request with no other approver. Its card does not appear on the panel either. ## Request types Each request type appears on the panel only when an administrator enables it. | Request type | What the user requests | Who approves | | --- | --- | --- | | **Role request** | One or more roles from the list of roles available for request. | Global approvers. | | **Access policy request** | Membership in an access policy that an administrator released for request. | PAM Core in the static model: the administrators of that access policy. Otherwise: global approvers. | | **Access policy administration request** | Administration rights on an access policy the user is already a member of. | The administrators of that access policy. | | **Handover of access policy administration** | Transfer of the user's administration rights on an access policy to another user, who replaces the user as administrator. | The user who receives the administration rights. | | **Credential request** | A new domain credential, stored in the vault. | Approved automatically. | | **AD Account Provisioning** | A new Active Directory account, named from a mask the administrator defines. | Approved automatically. Global approvers receive an email. | Users can request access policies from PAM Core, Cloud IAM, DevOps Secret Manager (DSM), Task Manager, and Certificate Manager. Each product has its own toggle, its own list of access policies released for request, and its own card on the panel. Users see only the access policies an administrator released. Only active access policies can be released. Access policies with **Block During Freezing?** enabled cannot be released. More information in [Emergency panel](/v4-2/docs/administration-emergency-panel). Access policy administration and handover are available only for PAM Core. ## Access policy mode Some request types depend on how your instance manages access policies. Policy administrators exist only in the static access policy model, so administration requests and handovers appear only in that model. | Request type | Static model | Dynamic model | | --- | --- | --- | | **Role request** | Available | Available | | **Access policy request** | Available. For PAM Core, the policy administrators approve. | Available. Global approvers approve. | | **Access policy administration request** | Available | Not available | | **Handover of access policy administration** | Available | Not available | | **Credential request** | Available | Available | | **AD Account Provisioning** | Available | Available | In the dynamic model, the settings screen hides the toggles for access policy administration requests and handovers. ## Audit trail Segura records who requested what, the justification, the decision, who decided, and when. Auditors and administrators review this history on the **All requests** screen, which lists only Self-service requests. ## When to use it - A user needs a role for a new task and should not wait for an administrator to assign it by hand. - A user needs access to an access policy and the policy administrators should decide. - A policy administrator leaves a team and hands administration of a policy to a colleague. - Your team needs auditable evidence of who requested and approved privileged access. ## Related topics - [Configure Self-service](/v4-2/docs/self-service-how-to-configure) - [Request access through Self-service](/v4-2/docs/self-service-how-to-request-access) - [Approve or reject a Self-service request](/v4-2/docs/self-service-how-to-approve-or-reject-a-request) - [Self-service panel and request screens](/v4-2/docs/self-service-panel-and-requests) - [Self-service settings](/v4-2/docs/settings-self-service)