---
title: About controlled support access
summary: >-
  This guide describes what controlled support access (CSA) is and how Fastly's
  access to your account works.
url: >-
  https://www.fastly.com/documentation/guides/organizations-and-accounts/company-account-settings/controlled-support-access/about-controlled-support-access
---

Helping you troubleshoot issues, configure services, or respond to incidents sometimes requires Fastly to make changes in your account on your behalf. Controlled support access (CSA) puts those changes under your control. Fastly retains read-only access to your account, but any action that changes your configuration or affects your traffic requires your explicit approval. You decide whether to allow this access, to what extent, and for how long. Every action is recorded in your [audit log](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-activity-and-notifications/monitoring-account-activity-with-the-audit-log/). Check out our guide to [getting started with controlled support access](https://www.fastly.com/documentation/guides/organizations-and-accounts/company-account-settings/controlled-support-access/getting-started-with-controlled-support-access/) to learn more about enabling it.

> **IMPORTANT:** 
>
> Controlled support access does not apply to [Fastly Next-Gen WAF](https://docs.fastly.com/products/fastly-next-gen-waf) or [Bot Management](https://docs.fastly.com/products/bot-management).
>
>
>
>

## How controlled support access works

Once controlled support access is enabled for your account, the access Fastly can have falls into two kinds: read-only access that allows us to view your account, and access that permits us to make changes to it.

Read-only access lets Fastly view your account but not change anything in it. Fastly always has read-only access, and it does not require your approval. Read-only activity is not recorded in your customer-facing audit log.

With the exception of [emergency access activities](https://www.fastly.com/documentation/guides/organizations-and-accounts/company-account-settings/controlled-support-access/about-controlled-support-access#emergency-access), access that changes your account requires your explicit approval, and every change is recorded in your audit log. Changes come in two forms. Write actions can create or stage configurations without affecting live traffic, such as drafting a service version. Enforcing actions immediately affect production traffic, such as activating a service, deploying a security rule, or blocking traffic. Both forms require an approved access session before Fastly can perform them.

## About the access request and approval process

An access session begins when Fastly requests access and you approve it, or when you [grant a session proactively](https://www.fastly.com/documentation/guides/organizations-and-accounts/company-account-settings/controlled-support-access/managing-controlled-support-access-requests/), before Fastly asks, for work you can anticipate.

A Fastly employee starts an approval process by requesting access for a stated purpose, scope, and duration (for example, if we observe major service degradation). Superusers and support admins on your account receive the request as an [alert in the notification center](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-activity-and-notifications/about-the-notification-center/) of the Fastly control panel and an email. The email contains the request details and directs you to the control panel to approve or deny the request. Approval and denial happen there, not through links in the email.

When you approve a request, the access session begins immediately for the approved scope and duration. The session ends automatically when the approved time expires. You can also end an active session early, and Fastly's security team can terminate a session as well. If you do not act on an approval request, it will expire after seven days and Fastly will have to resubmit the request to receive access.

A session cannot be extended while it is active. If a Fastly employee needs more time, they submit a new request, which creates a new session with its own approval and its own audit record. Work that was saved or staged during a session remains in place and can be resumed under a new approved session.

The choices you make across these requests, how you grant access, for how long, and how you review it, add up to an access posture. [Understanding your controlled support access posture](https://www.fastly.com/documentation/guides/organizations-and-accounts/company-account-settings/controlled-support-access/understanding-your-controlled-support-access-security-posture/) walks through those choices.

## Access authorized by contract

Some access is authorized in advance through a contractual agreement rather than approved case by case. For example, [Managed Security Services (MSS)](https://docs.fastly.com/products/product-support#_advanced-security) allows Fastly to act quickly when the terms of that agreement call for it. This access uses the same controlled support access model: it is scoped, time-bound, and fully recorded in your audit log. The difference is that the per-request approval step is automatically satisfied by the existing agreement, rather than requested each time.

## Emergency access

In rare situations that threaten platform stability or require an urgent response, such as an active outage, Fastly may need to act before your approval can be obtained. For these situations, Fastly maintains a tightly governed emergency access process.

An emergency access session allows temporary access for a fixed period of 60 minutes and expires automatically. Every emergency access session requires a written justification at the time it is initiated, and every session is logged and undergoes a mandatory review after the event.

You are notified when emergency access is used for your account. All emergency access appears in your audit log regardless of notification timing.

> **IMPORTANT:** Per our [Acceptable Use Policy](https://www.fastly.com/acceptable-use), Fastly reserves the right to suspend or shut down abusive services to protect the platform and downstream users. These enforcement actions follow established abuse and legal response workflows and do not require CSA approval or emergency access.

## Transparency and audit logging

Every CSA-related event is recorded: requests, approvals, denials, session starts and ends, and the write and enforcing actions taken during a session. Your customer-facing audit log identifies the actions Fastly takes in your account, along with the time, the scope of access, and the duration of the session. This gives you a record of who accessed your account, what they did, and when, which you can use for security reviews, investigations, and compliance reporting.