> ## Documentation Index
> Fetch the complete documentation index at: https://docs.glam.systems/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control

The `access` sub-client provides methods for managing vault permissions, enabling integrations, and configuring delegate access. This guide covers how to use the SDK to implement granular access control for your vault.

## When to Use Access Control

Access control is essential when you need to:

* **Delegate operations** - Allow bots, managers, or multisig members to perform specific actions
* **Enable protocol integrations** - Activate DeFi protocols (Jupiter, Kamino) for your vault
* **Enforce guardrails** - Set allowlists/blocklists for transfers and swaps
* **Emergency management** - Quickly revoke compromised delegate access

## Permission Hierarchy

```mermaid theme={null}
graph TB
    V[Vault]

    V --> IA[Integration ACLs]
    V --> DA[Delegate ACLs]

    IA --> PB[Protocol Bitmask]
    PB --> PP[Protocol Policies]

    DA --> IP[Integration Permissions]
    IP --> PRM[Protocol Permissions]

    IA -.- IA_DESC["Which programs can interact"]
    PB -.- PB_DESC["Which protocols within<br/>program are enabled"]
    PP -.- PP_DESC["Custom rules like allowlists"]

    DA -.- DA_DESC["Who can act on<br/>behalf of owner"]
    IP -.- IP_DESC["Per-integration access"]
    PRM -.- PRM_DESC["Bitmask of allowed actions"]

    style V fill:#010101,stroke:#fefefe,color:#fefefe,stroke-width:3px
    style IA fill:#333,stroke:#fefefe,color:#fefefe
    style DA fill:#333,stroke:#fefefe,color:#fefefe
    style PB fill:#444,stroke:#fefefe,color:#fefefe
    style PP fill:#555,stroke:#fefefe,color:#fefefe
    style IP fill:#444,stroke:#fefefe,color:#fefefe
    style PRM fill:#555,stroke:#fefefe,color:#fefefe
    style IA_DESC fill:none,stroke:none,color:#888
    style PB_DESC fill:none,stroke:none,color:#888
    style PP_DESC fill:none,stroke:none,color:#888
    style DA_DESC fill:none,stroke:none,color:#888
    style IP_DESC fill:none,stroke:none,color:#888
    style PRM_DESC fill:none,stroke:none,color:#888
```

* **Integration ACLs** define which external programs (Jupiter, Kamino) can interact with your vault and what protocol-specific policies apply.
* **Delegate ACLs** control which external accounts can act on behalf of the vault owner, with permissions scoped per integration and protocol.

## Enabling Protocols for Integrations

Before a vault can interact with DeFi protocols, you must enable them at the integration level.

### Enable Protocols

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });

// Get protocol info by name
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);
const [integrationProgram, protocolBitflag] = permissionsMap["JupiterSwap"];

// Enable Jupiter Swap for the vault
const txSig = await glamClient.access.enableProtocols(
  new PublicKey(integrationProgram),
  parseInt(protocolBitflag, 2)
);
```

### Disable Protocols

```typescript theme={null}
// Disable Jupiter Swap
const txSig = await glamClient.access.disableProtocols(
  new PublicKey(integrationProgram),
  parseInt(protocolBitflag, 2)
);
```

## Managing Delegate Permissions

Delegates start with no permissions and must be explicitly granted access.

### Grant Permissions

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";
import { BN } from "@coral-xyz/anchor";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });

// Grant delegate permission to swap tokens via Jupiter
const delegatePubkey = new PublicKey("De1egate111111111111111111111111111111111111");
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);
const [integrationProgram, protocolBitflag] = permissionsMap["JupiterSwap"];

// Permission bits: SwapAny=0b001, SwapLST=0b010, SwapAllowlisted=0b100
const permissions = new BN(0b001); // SwapAny permission

const txSig = await glamClient.access.grantDelegatePermissions(
  delegatePubkey,
  new PublicKey(integrationProgram),
  parseInt(protocolBitflag, 2),
  permissions
);
```

### Revoke Permissions

```typescript theme={null}
// Revoke specific permissions from delegate
const txSig = await glamClient.access.revokeDelegatePermissions(
  delegatePubkey,
  new PublicKey(integrationProgram),
  parseInt(protocolBitflag, 2),
  permissions // permissions to revoke
);
```

## Protocol Policies

Policies add parameter-level access control through allowlists and blocklists.

### Set Transfer Allowlist

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName, TransferPolicy } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);

// Create policy with allowed destination addresses
const destinationAddress1 = new PublicKey("Dest1nation11111111111111111111111111111111");
const destinationAddress2 = new PublicKey("Dest2nation11111111111111111111111111111111");

const policy = new TransferPolicy([]);
policy.allowlist.push(destinationAddress1);
policy.allowlist.push(destinationAddress2);

// Get SPL Token protocol info
const [splProgram, tokenBitflag] = permissionsMap["SplToken"];

const txSig = await glamClient.access.setProtocolPolicy(
  new PublicKey(splProgram),
  parseInt(tokenBitflag, 2),
  policy.encode()
);
```

### Set Swap Policy

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName, SwapPolicy } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);

// Create policy with allowed tokens for swapping
const allowedTokenMint1 = new PublicKey("Token1Mint1111111111111111111111111111111111");
const allowedTokenMint2 = new PublicKey("Token2Mint1111111111111111111111111111111111");

const policy = new SwapPolicy([]);
policy.allowlist.push(allowedTokenMint1);
policy.allowlist.push(allowedTokenMint2);

const [jupiterProgram, swapBitflag] = permissionsMap["JupiterSwap"];

const txSig = await glamClient.access.setProtocolPolicy(
  new PublicKey(jupiterProgram),
  parseInt(swapBitflag, 2),
  policy.encode()
);
```

## Emergency Access

Emergency updates bypass timelock for critical security situations.

```typescript theme={null}
import { GlamClient } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });

// Emergency disable a compromised delegate
const compromisedDelegatePubkey = new PublicKey("Compromised11111111111111111111111111111111");

const txSig = await glamClient.access.emergencyAccessUpdate({
  disabledIntegrations: [],
  disabledDelegates: [compromisedDelegatePubkey],
  stateEnabled: true // keep vault enabled, just disable delegate
});
```

<Warning>
  Emergency access updates bypass the timelock and should only be used when immediate action is required.
</Warning>

## Common Patterns

### Trading Bot Setup

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";
import { BN } from "@coral-xyz/anchor";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);

// 1. Enable Jupiter Swap for the vault
const [jupiterProgram, jupiterBitflag] = permissionsMap["JupiterSwap"];
await glamClient.access.enableProtocols(
  new PublicKey(jupiterProgram),
  parseInt(jupiterBitflag, 2)
);

// 2. Grant bot delegate swap permissions
const botWallet = new PublicKey("TradingBot11111111111111111111111111111111");
await glamClient.access.grantDelegatePermissions(
  botWallet,
  new PublicKey(jupiterProgram),
  parseInt(jupiterBitflag, 2),
  new BN(0b001) // SwapAny permission
);
```

### Multisig Manager Setup

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";
import { BN } from "@coral-xyz/anchor";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);

// Different managers with different responsibilities
const treasuryManager = new PublicKey("Treasury111111111111111111111111111111111");
const lendingManager = new PublicKey("LendingMgr11111111111111111111111111111111");

// Enable Kamino Lending for the vault
const [kaminoLendingProgram, lendingBitflag] = permissionsMap["KaminoLend"];
await glamClient.access.enableProtocols(
  new PublicKey(kaminoLendingProgram),
  parseInt(lendingBitflag, 2)
);

// Treasury manager: deposit/withdraw only
await glamClient.access.grantDelegatePermissions(
  treasuryManager,
  new PublicKey(kaminoLendingProgram),
  parseInt(lendingBitflag, 2),
  new BN(0b00110) // Deposit + Withdraw
);

// Lending manager: full lending operations
await glamClient.access.grantDelegatePermissions(
  lendingManager,
  new PublicKey(kaminoLendingProgram),
  parseInt(lendingBitflag, 2),
  new BN(0b11110) // Deposit + Withdraw + Borrow + Repay
);
```

### AI Yield Optimizer

```typescript theme={null}
import { GlamClient, getProgramAndBitflagByProtocolName } from "@glamsystems/glam-sdk";
import { PublicKey } from "@solana/web3.js";
import { BN } from "@coral-xyz/anchor";

const glamClient = new GlamClient({ statePda: vaultStatePubkey });
const permissionsMap = getProgramAndBitflagByProtocolName(glamClient.staging);

// Enable Kamino lending and vaults
const [kaminoLendingProgram, lendingBitflag] = permissionsMap["KaminoLend"];
const [kaminoVaultsProgram, vaultsBitflag] = permissionsMap["KaminoVaults"];

await glamClient.access.enableProtocols(
  new PublicKey(kaminoLendingProgram),
  parseInt(lendingBitflag, 2)
);

await glamClient.access.enableProtocols(
  new PublicKey(kaminoVaultsProgram),
  parseInt(vaultsBitflag, 2)
);

// Grant AI agent permission to deposit/withdraw across protocols
const aiAgent = new PublicKey("AiAgent1111111111111111111111111111111111111");

await glamClient.access.grantDelegatePermissions(
  aiAgent,
  new PublicKey(kaminoLendingProgram),
  parseInt(lendingBitflag, 2),
  new BN(0b00110) // Deposit + Withdraw
);

await glamClient.access.grantDelegatePermissions(
  aiAgent,
  new PublicKey(kaminoVaultsProgram),
  parseInt(vaultsBitflag, 2),
  new BN(0b11) // Deposit + Withdraw
);
```

## References

* [Permissions](/v1/access-control/delegated-accounts#permissions) - Permission definitions
* [Access Control Framework](/v1/access-control/framework) - Conceptual overview
* [Delegated Accounts](/v1/access-control/delegated-accounts) - Permission definitions
* [Use Cases](/v1/access-control/use-cases) - Real-world scenarios