Access Requests

What are access requests?

Access Requests allow external users to request access to an ACC project through a structured form. When a form is linked to a Project Matrix, users select their party, functions, and disciplines from the matrix values, and Foreman resolves those selections into concrete ACC roles.

Linking a form to a matrix

When creating an access request form, you select a matrix configuration from a dropdown that shows all configs for the project (the most recently updated one is marked with a star). Setting the form's role selection mode to Fixed enables matrix-based role selection.

The public form

Access request forms can be shared via a public URL. The public form loads the full matrix config and presents three selectors:

1. Party (L1) — Single selection: pick one party.
2. Functions (L2) — Multi-selection: pick one or more functions.
3. Disciplines (L3) — Multi-selection: pick one or more disciplines.

Overrides are applied: if the selected party has restrictions, only the allowed L2/L3 values appear. "General" is always included as an L2 function regardless of the user's selection.

Role group auto-detection

Values like "All" or "General" that belong to role groups with wildcard flags behave differently on the form:

• They are hidden from manual selection — the user can't click on them directly.
• They appear as locked purple pills when the match condition is met:
  • "All" mode — every other selectable value in the group is selected.
  • "Any" mode — at least one selectable value is selected.
• A purple info panel below the disciplines shows which role groups have been auto-included.

Admin review

When reviewing a request, administrators see:

• Auto-included role groups shown as locked purple badges.
• Individually selected roles shown as regular blue badges.
• The ability to modify the final role list (replace or add roles).
• An option to grant project administrator access.

Provisioning

After a request is approved, Foreman automatically adds the user to the ACC project with the approved roles. Role group names are valid ACC role names and are resolved to role IDs via the project's CSV, just like individual roles. A notification email is sent to the requester.