# Client access map

From the guide: https://www.joinlegion.io/resources/access-by-person-project-and-client

One row per identity and grant. Never write a key, token or password in this file.

## Access matrix

| Role or identity | Person or machine | Client code | Service | Environment | Allowed action | Owner | Review date |
|---|---|---|---|---|---|---|---|
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |

## Setup checks

- [ ] Every service with a key is listed with its owner.
- [ ] Every person has their own identity. Every agent or server has its own machine identity.
- [ ] Each identity can reach only the client projects and environments its work needs.
- [ ] Work runs with keys loaded for one command, not from a shared file.
- [ ] Old .env files with direct provider keys are deleted.
- [ ] You can say who ran a paid job, for which client and campaign.
- [ ] Spend limits live in the workflow (campaign ceiling), not in this map.

## When an assignment changes

- [ ] Remove the identity from the client project the same day.
- [ ] List every key that identity could read.
- [ ] Rotate those keys and confirm the old ones fail.
- [ ] Update this map and the review date.