By default, an object in [Automation Hub](/docs/automation) can be managed by all [users](/docs/settings/identity-access-management/users) with the [required permissions](/docs/settings/identity-access-management/permissions/automation-permissions). You can limit access per object to a selection of users or roles.

This is available for:
- Workflows
- Transformations
- Sequences
- Incoming integrations
- Outgoing integrations

## Considerations for access settings

- All users with "read" permissions to the relevant Automation Hub permission group have at least read-only access to the object, regardless of per-object access settings.
- The [PROFILE_ADMIN role](/docs/settings/identity-access-management/permissions#basic-roles) always has unlimited access, regardless of per-index access settings.
- If you configure different permissions for a user than for their roles, all granted permissions are combined.  
    **For example**:
    1. You grant only the "edit" permission to a user.
    2. You grant only the "delete" permission to a role where this user belongs.
    3. In result, the user has both "edit" and "delete" permissions.
- Changing the access settings doesn't grant module permissions to users or roles.  
  **For example**:
  1. A user role only has "read" access to the Automation Hub.
  2. You edit the settings of a workflow to give "edit" permissions to that role.  
  3. In result, users with the role **can't** edit the workflow, because per-object access settings only restrict permissions - they don't grant permissions beyond what the role already has.

## Changing access settings

To change the access settings:
1. Go to <img src="/api/docs/image/2436c30192e8593e9ecf626c4e413c341b9bf9bb/icons/automation-hub-icon.svg" alt="Automation Hub icon" class="icon" > **Automation Hub**, and open the **Workflows**, **Transformations**, **Sequences**, **Incoming**, or **Outgoing** list.
2. In the list, find the object you want to manage and click the padlock icon.  
    **Result**: The access management panel opens.
3. From the **Permission in this object** dropdown list, select an option:
   - **Public**: everyone with the required permissions can access and manage the object.
   - **Read only**: everyone with module permissions can access the object, but only the creator and administrators can edit or delete it.
   - **Restricted**: you can manage edit and delete permissions separately for different users and roles.
4. If:
   - you selected **Public** or **Read only**, click **Apply** to save and start enforcing the settings.
   - you selected **Restricted**, proceed to [configuring the details (next step)](#restricted-config).
5. <span id="restricted-config"></span>Configure the settings for **Users** and **Roles**:  
   1. Expand the options and configure them:
      - For **Users**:
        1. To add a user to the list of managed users, enter their name or email address in the search box and click their name.
        2. Repeat to add more users.
        3. Confirm by clicking **Add user**.
        4. Use the checkboxes to set the permissions for each added user.
        5. To remove a user from the list of permission settings, click <img src="/api/docs/image/2436c30192e8593e9ecf626c4e413c341b9bf9bb/icons/threedoticon.svg" alt="Three-dot icon" class="icon"> next to their name and click **Remove user**.
      - For **Roles**:
        1. Expand the list.
        2. Use the checkboxes to set the permissions for each role.
6. To save and start enforcing the settings, click **Apply** in the lower-right corner.