As long as you are a member of the Vault Admins group you can grant any permission on any safe.

The statement is correct. The Vault Admins group is a built-in, highly privileged administrative group in the CyberArk Vault. By default, members of this group are granted the Manage Safes authorization at the Vault level. This specific authorization empowers them to perform all administrative actions on any safe, which includes adding or removing safe members and modifying their specific permissions within that safe. Therefore, a Vault Admin has the inherent capability to grant any permission on any safe.

The statement is not false. While a user typically needs the Manage Safe Members permission within a specific safe to modify its membership, the Vault Admins group's Vault-level Manage Safes authorization supersedes this requirement. This overarching authorization grants them the power to manage members and permissions on all safes without needing to be an explicit member of each one first.

1. CyberArk Privileged Access Security Documentation - Built-in Users and Groups: The Vault Admins group is described as a predefined group for Vault administrators. The documentation lists its default authorizations

which include Manage Safes. This authorization is the foundation of their ability to control all safes.

Source: CyberArk Privileged Access Security Documentation

"Vault Users and Groups

" Section: "Built-in Users and Groups."

2. CyberArk Privileged Access Security Documentation - Safe Authorizations: This section details the specific capabilities granted by different authorizations. The Manage Safes authorization is explicitly defined as enabling a user to "Add and remove Safe members

and change their authorizations." This directly confirms that members of the Vault Admins group can grant any permission on any safe.

Source: CyberArk Privileged Access Security Documentation

"Safes and Safe Members

" Section: "Safe Authorizations."

3. CyberArk Privileged Access Security Documentation - Add a Safe member: The procedure for adding a safe member notes that the action requires the Manage Safe Members permission in the Safe. However

it is understood from the hierarchy of permissions that the Vault-level Manage Safes authorization held by Vault Admins provides this capability globally across all safes.

Source: CyberArk Privileged Access Security Documentation

"Safes and Safe Members

" Section: "Add a Safe member."