---
title: "Direct and indirect access"
url: "https://docs.4hse.com/users-and-permissions/direct-and-indirect-access"
description: "The difference between being assigned to a group and reaching an entity through a relation, and why a user may appear where you did not put them."
---

# Direct and indirect access

A user obtains permissions in two ways. Telling them apart is what lets you answer the question “why does this person see this?”.

## Direct access

[Section titled “Direct access”](#direct-access)

The user is explicitly assigned to a group of an entity — a project, an office, a person, a supplier. It is a manual assignment, and it grants the permissions of that group on that entity and on everything directly linked to it.

## Indirect access

[Section titled “Indirect access”](#indirect-access)

The user was never assigned to that entity, but reaches it through a relation. Think of it as a network: the user is assigned to a “child” entity, the child belongs to a “parent”, and the user therefore reaches the parent too — indirectly.

## Why this matters in practice

[Section titled “Why this matters in practice”](#why-this-matters-in-practice)

The **Users** sub-menu of an entity lists only who has **direct** access to it. Someone can therefore operate on a project without appearing in its list — because their access comes from an office, a person or a supplier below it.

When a user sees more than you expect, look down, not up: the permission usually comes from an entity further along the chain. The propagation rules are in [Permission inheritance](/users-and-permissions/permission-inheritance).

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.