> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/access-management/just-in-time-access/access-bundles.md).

# Access bundles

An Access Bundle groups multiple resource accesses into a single requestable item. Instead of filing separate requests for an AWS role, a Google Cloud role, and a Kubernetes namespace, a user requests one bundle and P0 provisions every resource in it after approval.

Bundles are useful when a task consistently requires the same set of permissions across integrations, for example onboarding an engineer to a service or granting a standard "incident responder" access set.

{% hint style="info" %}
Access Bundles are in **beta**. The feature and its interface may change.
{% endhint %}

## How Access Bundles work

1. An **Owner** creates a bundle in Policy Studio and adds 2-15 resources from your installed integrations.
2. A user **requests** the bundle from the web app or Slack.
3. P0 **routes** the request to the approvers configured on the bundle.
4. After approval, P0 **provisions** every resource in the bundle through its own integration.
5. Access **expires** after the requested duration, the same as any other just-in-time request.

Each item in a bundle keeps the access behavior of its underlying integration. A bundle is a way to request several accesses together, not a new kind of grant.

## Prerequisites

Before you begin, confirm the following:

* The **Owner** role in your P0 organization (required to create and manage bundles).
* At least two [resource integrations](/integrations/resource-integrations.md) installed and configured, so the bundle has resources to include.

## Create an Access Bundle

### Open the Access Bundles view

1. Sign in to [p0.app](https://p0.app).
2. Navigate to **Policy Studio** in the sidebar.
3. Select **Access Bundles** in the category control at the top of the page.

<figure><img src="/files/CyEB7Fwof9G1I0VLfKTe" alt="" width="563"><figcaption></figcaption></figure>

You see a list of existing bundles. The list is empty the first time you open it.

### Start a new bundle

1. Click **Create Bundle**.

   The bundle editor opens with three sections: **Identity**, **Resource(s)**, and **Actions**. Configure each one in order.
2. Enter a name for the bundle in the name field at the top (for example, "Incident responder").

<figure><img src="/files/s2xeGYvfWaSeb1jJauJI" alt="" width="435"><figcaption></figcaption></figure>

{% hint style="info" %}
Access Bundles are edited only in the visual editor. Unlike access policies, they can't be edited as YAML.
{% endhint %}

### Define who can request the bundle

The **Identity** section specifies which users can request this bundle.

<figure><img src="/files/1CNDDiamWn9pZYzYReSY" alt="" width="388"><figcaption></figcaption></figure>

1. In the **Identity** section, select one of the following:
   * **Any user**: Any user in your organization can request the bundle.
   * **Specific users**: A specific user or directory group can request the bundle. Then, in the **Match by** row, select **Specific user** or **Directory group**.
2. If you selected **Specific users**, choose a specific user's email address or a directory group.

### Add resources to the bundle

The **Resource(s)** section defines what the bundle grants. A bundle must contain at least 2 and at most 15 resources.

<figure><img src="/files/aTivjciSYTLB16SsF1cL" alt=""><figcaption></figcaption></figure>

1. Click **Add to Access Bundle**.
2. Select the integration for the resource (for example, **AWS**, **Google Cloud**, or **Kubernetes**).
3. Select the access type and the specific resource for that integration.
4. Repeat for each resource you want to include. Resources are grouped by integration in the editor.

{% hint style="info" %}
If you add the same resource and access type twice, the editor flags the duplicate and excludes it from the saved bundle.
{% endhint %}

### Define how requests are approved

<figure><img src="/files/IAeG675Zag8QKLDt9Ylw" alt="" width="240"><figcaption></figcaption></figure>

The **Actions** section specifies how P0 handles requests for the bundle. This works the same way as approvals on an [access policy](/access-management/just-in-time-access/access-policies/configure-your-first-access-policy.md#define-the-actions-how-requests-are-approved).

1. Select an approval type (for example, **P0 Security Reviewers**, **Group approval**, or **Auto-approve (on-call)**).
2. Configure approval options as needed, such as **Require reason with request**.

If you don't configure an approval, P0 routes bundle requests to your configured Security Reviewers by default.

### Save the bundle

1. Review the bundle across all three sections.
2. Click **Create Access Bundle**.

The bundle appears in the Access Bundles list with the **Enabled** toggle turned on. It is now available for users who match the identity you configured.

## Request an Access Bundle

Users request a bundle the same way they request any other resource, by selecting **Access Bundle** as the resource type. Bundles can be requested from the web app and from Slack.

### Request from the web app

<figure><img src="/files/ZMQ6X9hPY04gJOTHBWI0" alt="" width="388"><figcaption></figcaption></figure>

1. Open the [P0 app](https://p0.app) and navigate to **Access Management**.
2. Click **Request Access**.
3. Select **Access Bundle** as the resource, then select the specific bundle.
4. Set the duration and, optionally, a reason.
5. Submit the request for approval.

### Request from Slack

If your organization has installed the [Slack integration](/integrations/notifier-integrations/slack.md), type `/p0 request` and select **Access Bundle** in the request modal, then choose the bundle to request.

For more ways to request access, see [Requesting Access](/access-management/just-in-time-access/requesting-access.md).

## Manage bundles

From the **Access Bundles** list, an Owner can:

* **Edit a bundle**: Click a bundle row to open the editor and change its identity, resources, or approval.
* **Disable a bundle**: Turn off the **Enabled** toggle. Disabled bundles aren't available for requests.
* **Delete a bundle**: Click the delete icon on the bundle row. This action can't be undone.

## Related

* [Configure your first access policy](/access-management/just-in-time-access/access-policies/configure-your-first-access-policy.md): Control who can request individual resources and how those requests are approved.
* [Requesting Access](/access-management/just-in-time-access/requesting-access.md): All the ways users can request access in P0.
* [Approving Access](/access-management/just-in-time-access/approving-access.md): How approvers review and manage requests.