---
title: "Managing access to Secrets"
canonical: "https://support.appfire.com/space/SECC/477725978/Managing%20access%20to%20Secrets"
format: markdown
---
> Macro (aura-html)
> ℹ️ [DECember 2023] We have released an improved version with enhanced security of Security and Encryption for Confluence Cloud. Check out the [next steps for administrators](https://appfire.atlassian.net/wiki/spaces/SECC/pages/477727589).
## Overview
This page covers who can create, view, update, and delete secrets.
You need to ensure that users or groups have been granted Add/Delete Restrictions to allow for continued creation and editing of secrets
- space admins are users that have been granted Add/Delete Restrictions permission in a space
- non-space admins are users who have not been granted Add/Delete Restrictions permission in a space.
## Creating a secret
To create a Secret macro, you must have the following requirements:
- You have access to the space where you want to add the Secret macro.
- You have Edit permission for the page where you want to add the Secret macro.
- You have Add/Delete Restrictions permission in that space.
## Updating a secret
To edit a Secret macro, you must be the owner of the secret, either as an individual “User Owner” or a member of a “Group Owner”.
When a user edits a secret, the user will be made User Owner automatically, as long as the user is part of the group. By default, the secret creator is also the owner.
The secret owner can add other users as owners. For details refer to [creating and editing secrets](https://appfire.atlassian.net/wiki/spaces/SECC/pages/477726008) documentation.
## Granting access to Confluence users to create secrets
For individual users
- in **Space permissions**, in the **Individual Users **section
- grant the user **Add/Delete** permission under **Restrictions**
> 📝 Granting the permission allows the user to add/delete restrictions to other pages in that space.
For groups
- in **Space permissions**, in the **Groups **section
- grant a group **Add/Delete **permission under **Restrictions**
> 📝 Granting the permission allows the members of the group to add/delete restrictions to other pages in that space.
> ℹ️ App user permissions will retain [legacy secret](https://appfire.atlassian.net/wiki/spaces/SECC/pages/477727740) behaviour. Newly created secrets that utilize zero-knowledge architecture depend on individual user or group permissions.
## FAQs and common scenarios
I am the owner of a Secret and I want to transfer ownership to another user (e.g. I am leaving the company or I am being transferred to another team)
Currently, you cannot remove yourself as a secret owner. Instead, add another user as an owner, and request that user to remove your ownership.
We have introduced group-related access to assist with ownership transfers - for more details see [How to ensure that secrets-related access is not impacted by a change of owners](https://appfire.atlassian.net/wiki/spaces/SECC/pages/477726542).
I have other apps installed. Do I need to take any precautions to ensure that Secrets from the Security and Encryption app are safe from any potential impact from users of these other Confluence apps, for example, due to permissions given to a user by these apps?
Certain Confluence apps can bypass content restrictions on behalf of the user. Consequently, administrators must exercise caution when installing other Confluence apps to prevent such occurrences.
As an administrator, you need to compare the [Secrets permission matrix](https://appfire.atlassian.net/wiki/spaces/SECC/pages/543392538) and the other app users' permissions. Find further details [here](https://appfire.atlassian.net/wiki/spaces/SECC/pages/760184862).