# People and session policies
Source: https://docs.infraista.com/en/compute/workspaces/people-and-session-policies



Each workspace has its own list of people and its own session rules, on the **Users & access** tab.
Only the desktop's owners (and the organization's Owners and Admins) can change them.

## People with access [#people-with-access]

| Desktop role | Can                                                             |
| ------------ | --------------------------------------------------------------- |
| **Owner**    | Manage the desktop, its password and these settings, and use it |
| **User**     | Sign in and work                                                |
| **Viewer**   | See it, but not sign in                                         |

Organization Owners and Admins always have access.

* **Add someone**: enter their email under **Add by email**, pick a role and select **Add**. They must
  be a member of the organization.
* **Change a role** from the dropdown next to the person, or remove them.

The list shows when each person last signed in, and **Active now** for anyone connected.

## Session policies [#session-policies]

Checked each time someone connects:

| Policy                       | What it allows                                                            | Applies in                      |
| ---------------------------- | ------------------------------------------------------------------------- | ------------------------------- |
| **Clipboard copy and paste** | Copy text and images between your computer and the desktop                | Browser and Remote Desktop apps |
| **File transfer**            | Drag files in and download files out                                      | Browser and apps                |
| **Sound**                    | Play the desktop's sound on your computer                                 | Browser and apps                |
| **Microphone**               | Use your microphone on the desktop (you're asked first)                   | Browser and apps                |
| **USB redirection**          | Use local drawing tablets, drives and security keys                       | Remote Desktop apps only        |
| **Printing**                 | Print from the desktop to a local printer                                 | Remote Desktop apps only        |
| **Watermark**                | Show the user's email faintly across the screen to discourage screenshots | Browser only                    |

The browser enforces the clipboard and watermark itself. Remote Desktop apps get the other policies
through the .rdp file, which a determined user could edit.

**Sign in with Workspace ID** lets anyone with the ID and the desktop password connect from the
Workspaces app without an Infraista account. Attempts are rate-limited and recorded.

## Sessions [#sessions]

The **Sessions** tab shows who's connected now (with when they started, the app they use and their IP),
with **Disconnect** to end a session. Below it, **Session history** lists past sessions with their
duration; **Export CSV** downloads it. This month's totals show the number of sessions, hours per day
and the apps used.

## Related [#related]

* [Connect to a workspace](/en/compute/workspaces/connect-to-a-workspace)