--- title: "Access management" slug: "access-management-v6-5" description: "Learn how to configure access management with Policies, Entitlements, and Conditions for secure user and device provisioning in AppGate." updated: 2025-10-31T18:25:06Z published: 2025-10-31T18:25:05Z canonical: "support.appgate.com/access-management-v6-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Access management Access management is configured using a combination of Policies, , the Risk Model, Conditions and Scripts. These are the main elements you need for provisioning fine grained access to administrators, users and devices. Application Discovery can be a vital tool when you are migrating from a traditional network model to the ZTNA model. With a traditional VPN solution you may not really know which apps users are connecting to, so you can't easily define the Policies/Entitlements that Appgate SDP requires. [Application Discovery](/v1/docs/access-management) allows organizations to quickly identify which apps users are connecting to and then to create the appropriate Policies/Entitlements. Policies are the front door to the Appgate SDP system and assign rights to a users/devices after a successful sign-in. There are five different classes of Policy that can be assigned: - **Access** via Gateways based on Entitlements along with any related Conditions that apply - **Admin** rights to perform one or more administrative roles (admin UI & APIs) - **Device** controls which are pushed to the Client (Ringfence rules, Client profile settings, etc) - **DNS** settings comprising match-domain DNS settings along with the required Entitlements for the DNS servers specified - **Stop** assigning Policies and do not authenticate the user/device Policies are enabled on a per-user basis using Claims-based assignment expressions. The Controller manages this process and the resulting settings/Entitlements are then passed to the Client. Entitlements are assigned to users by Policies. Each Entitlement Token issued defines the Entitlements available to the specific user/device for a specific Site. The main elements of an Entitlement are: - the Client app shortcuts - the Actions - defining the (protected) hosts and the rule to be used (typically , but it can also be , or ). - any access controls imposed by Gateways relating to the Actions. is the default. provides an easy way to apply access controls without using Conditions. allows more complex configurations based on access criteria expressions or access criteria scripts. An Entitlement might be created for Site net1 to: TCP up to 10.0.0.1 on port 80, but only between 09.00 and 17.00. The most powerful way to set up access controls is to use [Condition based access](/v1/docs/access-control-modes). Conditions contain claims-based access criteria expressions that must equate to true for the Action(s) specified in the Entitlement to be allowed. For example: access may only be allowed if the user is working from an office-based IP address. When the criteria equate to false then the Entitlement will not be allowed (block rule applies). If a [user interaction](/v1/docs/applying-access-controls-user-interactions) has been configured in a Condition, this will be triggered when the access criteria equate to false. User interactions provide an alternative way for the user to unblock access - by updating claims or providing new claims that will now meet the access criteria. For example: providing multi-factor authentication could be an alternative method for gaining access if not working from an office-based IP address. The rest of this section focuses on how the controls actually work and the wider requirements that need to be considered in order to provision rights successfully. ![Flowchart illustrating user entitlement and policy creation processes with defined conditions and actions.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag53-user_access.png?sv=2026-02-06&spr=https&st=2026-10-27T19%3A30%3A34Z&se=2026-10-27T20%3A30%3A34Z&sr=c&sp=r&sig=D%2Beq%2B%2FKaocBcwedKEuKiJ%2FfeHgSbhq%2B8vCFVSF9BAF8%3D) Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model. A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements. Key-value pairs related to the identity and content of the user or device and are specific to each session. The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration. A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system. A digital key used to authenticate and authorize users or devices, enabling secure access to resources.