---
title: Configuring step security for automation processes
related:
  - https://docs.kentico.com/13/on-line-marketing-features/configuring-and-customizing-your-on-line-marketing-features/configuring-on-line-marketing-permissions.md
  - https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation/managing-the-flow-of-contacts-in-automation-processes.md
  - https://docs.kentico.com/13/managing-users/permission-model-overview.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

> **Info:** **Enterprise license required**
>
> Features described on this page require the **Kentico Xperience Enterprise** license.

Step security allows you to configure which users are allowed to manually move contacts between steps in [automation processes](https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation.md). This allows users to:

- Make user choices
- Override the automatic decisions of steps

You can set security options for the following types of steps:

- [If/Else](https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation/working-with-the-automation-process-designer/defining-automatic-decisions-in-processes.md)
- [Approve progress](https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation/working-with-the-automation-process-designer/defining-manual-choice-steps-in-automation-processes.md)
- [Manual choice](https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation/working-with-the-automation-process-designer/defining-manual-choice-steps-in-automation-processes.md)
- [Wait](https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation/working-with-the-automation-process-designer/adding-wait-steps-to-automation-processes.md)

The system applies step security when users [manage](https://docs.kentico.com/13/on-line-marketing-features/managing-your-on-line-marketing-features/marketing-automation/managing-the-flow-of-contacts-in-automation-processes.md) instances of the automation process for contacts.

> **Note:** **Marketing automation permissions**
>
> Users can override the security settings of specific automation process steps if they have the following [on-line marketing permissions](https://docs.kentico.com/13/on-line-marketing-features/configuring-and-customizing-your-on-line-marketing-features/configuring-on-line-marketing-permissions.md):
>
> - **Manage processes** – allows users to move contacts to the previous and next steps.
> - **Move to specific step** – allows users to move contacts to any other step in the given automation process.
>
> The permissions allow users to move contacts for all steps in any automation process, regardless of the step security settings.

## Allowing users to move contacts from steps

1. Edit the step by clicking it in the designer grid.
   - The designer opens a panel showing the details of the given step's configuration
2. Switch to the **Security** tab.
3. Select which [roles](https://docs.kentico.com/13/managing-users/role-management.md) are allowed to move contacts to the previous or next step:

   - **None**
   - **Only listed** – click **Add roles** to choose which roles are allowed to move contacts from the step.
   - **All except listed** – click **Add roles** to block roles from managing the step. Using this option automatically allows all other roles to move contacts from the step.

     > **Note:** **Important**: Automation processes run within a global context in certain scenarios. To allow moving of contacts from steps in all cases, you need to assign and select **Global** roles.
4. Configure the step security options for individual [user accounts](https://docs.kentico.com/13/managing-users.md):

   - **No extra users**
   - **Include the following users** – click **Add users** to choose which users are allowed to move contacts from the step.
   - **Exclude the following users** – click **Add users** to block specific users from managing the step.

The combination of the user and role settings defines which users are allowed to move contacts from the given step to the previous or next step.

### Setting security for steps with multiple branches

For steps that branch into multiple cases (choices), you can configure different security options for individual cases. By default, cases inherit the settings of their step.

1. Edit individual cases:
   - Directly in the process designer
   - On the **Cases** tab in the step configuration panel.
2. Open the **Security** tab of the given case.
3. Select which roles are allowed to move contacts forward through the corresponding branch:

   - **Use step settings** – uses the security settings of the main step.
   - **Only listed** – click **Add roles** to choose which roles are allowed to manually select the case for contacts in the step.
   - **All except listed** – click **Add roles** to block roles from selecting the case. Using this option automatically allows all other roles to select the case for contacts.
4. Configure the case security options for individual [user accounts](https://docs.kentico.com/13/managing-users.md):

   - **Use step settings** – uses the security settings of the main step.
   - **Include the following users** – click **Add users** to choose which users are allowed to manually select the case for contacts in the step.
   - **Exclude the following users** – click **Add users** to block specific users from selecting the case.

The combination of the user and role settings defines which users are allowed to manually move contacts forward to the process branch represented by the given case.