# Navigation tour

The vault's left sidebar is organized into three sections. Everything you need is reachable from there. This page gives you a quick orientation so you can find things without hunting.

![The Offchain Keys page after sign-in: the dark left sidebar with KEYS, ORGANIZATION, and SYSTEM sections, and the key inventory table on the right.](/img/guide/getting-started/keys-landing.png)
*The Offchain Keys page — where you land after signing in. The left sidebar is your primary navigation; the profile area sits at the bottom.*

## The sidebar sections

<img src="/img/guide/getting-started/sidebar.png" alt="The full sidebar expanded, showing the KEYS, ORGANIZATION, and SYSTEM section labels with every item, and the user profile at the bottom." width="260" />

*The full sidebar, shown roughly life-size. Everything in the vault is reachable from these three sections.*

### KEYS

This section covers your signing infrastructure.

| Item | What it does |
|---|---|
| Offchain Keys | The main key table. Import, generate, version, rotate, freeze, and delete API keys. Also contains the [Security Groups](/guide/keys/security-groups) sub-tab. |
| Signing Policy | The ordered rule list that determines whether a signing request is approved, denied, or escalated. |

{/* COMMENTED OUT — the Approval page is a non-functional mock today (human approval/quorum not implemented; see /introduction/coming-soon). Restore this KEYS row when wired:
  | Approval | Pending administrative approval requests requiring a quorum response. |
  */}

### ORGANIZATION

This section covers identity and access.

| Item | What it does |
|---|---|
| Admin Policy | Configures who can perform each administrative action. |
| Users & Groups | Creates and manages groups, human users, and machine users and agents. |

### SYSTEM

This section covers operational and compliance tooling.

| Item | What it does |
|---|---|
| Venues | Configuration for exchanges: signing scheme and encoding per venue. |
| Audit Logs | Tabbed log of all admin and signing events, with filters and CSV export. |
| Backup | Opens the backup modal to download an encrypted zip of all key shares. |

## How the app adapts to your permissions

Controls in the vault appear or are hidden based on what the current user is allowed to do. For example:

* The **Freeze All Keys** button on the Offchain Keys page only appears if you have the `freeze_keys` capability.
* The **Export CSV** button on the Audit Log page only appears if you have `view_export_audit_log`.
* Creating users, groups, or keys requires the corresponding admin policy capability; the "Create New" dropdown on the Users & Groups page will be absent if you lack `manage_users`.

The vault checks your capabilities on every page load. If an administrator changes policy while you are logged in, a page refresh reflects the change.

:::tip
If a button or section you expect is missing, check with your administrator. The most common cause is that the relevant action has not been assigned to any of your groups in the Administrative Policy.
:::

## The global freeze entry point

The **Freeze All Keys** button lives in the top-right area of the **Offchain Keys** page. It is intentionally prominent: pressing it triggers a confirmation modal that requires you to type `FREEZE ALL KEYS` before confirming. This is the fastest way to halt all signing activity across the entire vault in an emergency.

When all keys are already frozen, the button changes to **Unfreeze All Keys** (requiring you to type `UNFREEZE ALL KEYS` to confirm).

Individual keys can also be frozen or unfrozen per-row from their action dropdown.

## Account menu and passkeys

Your profile avatar and email address appear at the bottom of the sidebar. The passkeys management page is at `/passkeys` and lets you add or remove passkeys for your account. See [Passkeys and account security](/guide/users-groups/passkeys-account-security) for details.

![The bottom of the sidebar showing the user profile area: a circular avatar, the signed-in email address, and a chevron that opens the profile menu.](/img/guide/getting-started/profile.png)
*The profile area at the bottom of the sidebar. The chevron opens the account menu; passkey management lives at `/passkeys`.*