> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Profiles

<Note>
  CLI man page: `safesquid-profiles(5)`
</Note>

The **Access Profiles** section (`safesquid-profiles(5)`) is the central content-policy hub. Access restrictions decide *who* connects; Access Profiles decide *what* they may fetch. It combines Time Profiler, Request Types, Response Types, categories, and User-Groups, then adds profile tags and sets Allow/Deny.

<Note>
  Unlike Access restrictions (first match), **every** matching row in Default and Secondary Policies applies. Later rows see tags changed by earlier rows.
</Note>

## Profile pipeline

On each request (non-interface), SafeSquid builds label lists in this order before Access Profiles runs:

1. [Time Profiler](/admin_guide/policies_and_profiles/time_profiler) → `time_schedules`
2. [Request Types](/admin_guide/policies_and_profiles/request_types) → `request_types`
3. Domain categorization → `website_categories`
4. **Access Profiles** → `profiles` + `action`
5. [Response Types](/admin_guide/policies_and_profiles/response_types) on response headers/body → updates `response_types`; Access Profiles runs again

Access restrictions **User-Groups** populate `user_groups` (not `profiles`). Access Profiles **User Groups** gate matches those tags.

## Core mechanics

### List order

1. Clear the connection's profile tags; set the action to **ALLOW**.
2. Walk **Default Policies** top-down — every match applies.
3. Walk **Secondary Policies** top-down — same cumulative rules.
4. Final action not Allow → block (bypass cookie may apply).

<Frame caption="Access Profiles — gate order per row">
  <img src="https://mintcdn.com/safe-squid-labs-12a0916f/VRx-_vpMam8ezhZz/images/admin_guide/access_profiles_flowchart.svg?fit=max&auto=format&n=VRx-_vpMam8ezhZz&q=85&s=3b80c1fbcebc0e33062be48ce58743a4" alt="Access Profiles row gate flow" width="480" height="400" data-path="images/admin_guide/access_profiles_flowchart.svg" />
</Frame>

### Action values

* **Allow** — Default. Downstream sections use applied profile tags.
* **Deny** — Block. With Access **Allow bypassing**, temporary bypass cookie may be offered.
* **Do not bypass** — Hard block; no bypass cookie.
* **Inherit** — Keep action from earlier matching rows; use when row only adds/removes tags.

## Rule fields

All configured criteria on a row must match. Blank = any. Use `!` to negate tags in list fields.

* **Applicable Profiles** — Tags on connection from earlier rows in this pass (list is cleared at start).
* **Time Schedule** — Tags from [Time Profiler](/admin_guide/policies_and_profiles/time_profiler).
* **Request Types** — Tags from [Request Types](/admin_guide/policies_and_profiles/request_types).
* **Response Types** — Tags from [Response Types](/admin_guide/policies_and_profiles/response_types); requires response header when field set.
* **User Groups** — From Access restrictions. Non-blank + empty user\_groups → row skipped.
* **Categories** — Domain categories; empty lookup tests as `UNCATEGORIZED`.

## Examples

<Tip>
  ### LAN users + category deny

  **Config:** Default: User Groups `LAN_USERS`, add `users`, Inherit. Secondary: Categories `Social`, profiles `users`, Deny.

  **Result:** LAN traffic tagged; Social category blocked with row comment as reason.
</Tip>

<Tip>
  ### Time-gated exception

  **Config:** Time Profiler adds `LUNCH_TIME`; Secondary matches Time Schedule `LUNCH_TIME`, Allow streaming.

  **Result:** exception only during lunch window local time.
</Tip>

<Tip>
  ### Response-side deny

  **Config:** Response Types adds `executable_download`; Secondary matches that tag, Deny.

  **Result:** may not match until response headers arrive and profile matching runs again.
</Tip>

## How to verify

1. **Reports → Detailed logs** — profiles, request/response/time profile columns.
2. Enable **Trace Entry** on one row; check native logs.
3. Debug headers — `X-SafeSquid-Profiles`, `X-SafeSquid-Access-Policy`.


## Related topics

- [Suggested Profiles](/admin_guide/policies_and_profiles/suggested_profiles.md)
- [Access restrictions](/admin_guide/infrastructure_and_access/access_restrictions.md)
- [Access Remote Desktop Applications Through SafeSquid](/use_cases/access_restriction/access_remote_desktop_applications_through_safesquid.md)
- [First configuration](/admin_guide/start_here/first_configuration.md)
- [Allow Social Networking Sites During Lunch Hours](/use_cases/access_restriction/allow_social_networking_sites_during_lunch_hours.md)