Document and Authorize Privileged Users¶

Anyone with privileged access to your application in Game Warden must meet qualification requirements, receive a formal written appointment, and have their access documented. Maintain two documents to meet these requirements:

Tenant Privileged User Appointment Letter: Create one letter for each privileged user.
Tenant Privileged User Register: Maintain a centralized list of all privileged users.

This article explains who qualifies as a privileged user, how the two documents work together, how to appoint a user, and how to keep the register current.

Game Warden compares your register against its platform access records. Keep both documents accurate and up to date to avoid access suspension due to missing or outdated documentation.

Who counts as a privileged user¶

A person qualifies as a privileged user if they can perform any of the following actions for your application:

Deploy or modify the application
Change the application's configuration or secrets
Manage application users and roles
Access application databases directly
Review application security audit logs

Include Game Warden personnel who hold tenant-level administrative roles on your behalf in the register.

How the documents fit together¶

The Appointment Letter documents one person's appointment. The register tracks every privileged user for an application.

Privileged User Access Authorization & Briefing form
- Covers: One person
- Completed by: The user, their supervisor or sponsor, and the tenant ISSM
- When: Before granting access
- Submission to Game Warden: On request
Tenant Privileged User Appointment Letter
- Covers: One person
- Completed by: The Appointing Official (tenant ISSM or Application Owner) and the privileged user
- When: Before granting access; review at least quarterly
- Submission to Game Warden: On request
Tenant Privileged User Register
- Covers: Every privileged user for one application
- Completed by: The tenant ISSM and Application Owner
- When: At onboarding, whenever access or personnel change, after each quarterly review, and annually
- Submission to Game Warden: With every submission

Submit a separate register for each application. Create an individual Appointment Letter for every privileged user, including anyone who receives access later.

Before you begin¶

Gather the following for each privileged user:

Signed Privileged User Access Authorization & Briefing form, including supervisor and ISSM signatures.
Required training confirmation.
DoDM 8140.03 foundational qualification for the user's work role. See Meet the 8140 qualification requirement.
Citizenship status. See Check citizenship requirements.
CAC/PIV credentials for both the Appointing Official and the privileged user to support digital signatures.

Gather these application details:

Game Warden Tenant ID
Application Impact Level (IL)
Namespaces the privileged user will access

Contact your Mission Success Manager (MSM) to obtain blank copies of the Tenant Privileged User Appointment Letter and Tenant Privileged User Register.

Appoint a privileged user¶

Complete these steps before granting access:

Confirm that the person needs privileged access to perform their assigned duties.
Collect the signed Privileged User Access Authorization & Briefing form. Do not proceed until the supervisor and ISSM have signed it.
Verify the person's DoDM 8140 qualification and citizenship for the highest IL they will access.
Complete the Tenant Privileged User Appointment Letter:
Appointment Details: Enter the person's company, email, effective date, review or end date, and citizenship status. Enter the application name, Game Warden Tenant ID, namespaces, application IL, and highest IL accessed.
Privileged role(s): Select only the roles the person needs: App admin, Deploy / namespace admin, CI/CD maintainer, Database admin, IAM admin, Audit log reviewer, Break-glass, or Other.
Environment(s): Select only the environments the person needs: Production, Staging, Development, or Test.
DoDM 8140.03 Qualification: Enter the DCWF work role, proficiency level, qualification type, and credential or experience.
Obtain signatures using CAC/PIV digital signatures. The Appointing Official signs first, then the privileged user accepts the appointment.
Add the person to the register with Status Active. See Complete the register.
Grant access only to the roles and environments listed in the letter.
Upload the updated register to Game Warden. Keep the signed letter on file and provide it to Game Warden on request.

The appointment covers only the roles and environments you select. Issue a new letter whenever those assignments change.

The appointment ends on the earliest of these dates or events: the specified end date, written rescission of the appointment, or the date the person no longer needs access.

Complete the register¶

Note

The register is a template. Modify it to meet your contractual and Authorizing Official requirements.

Section I: Tenant information

Enter the tenant organization, application name, Tenant ID, IL, and contact information for the Application Owner, tenant ISSM, and Game Warden point of contact. Select the submission type that matches your reason for submitting the register:

Submission type	Use when
Initial onboarding	You are submitting the register for the first time.
Quarterly review	You have completed a quarterly access review.
Change (add / remove user)	You have added or removed a privileged user.
Annual reauthorization	You are completing the annual reauthorization.

Section II: Privileged user roster

Add one row for each privileged user and account for every environment the person can access. The register holds up to 42 users. Use another copy of the register if you need more rows.

Enter dates in DD MMM YYYY format, for example, 02 OCT 2026.

Set each person's Status based on their access:

Status	Meaning
Active	The person has access.
Pending	You are completing the required documentation, and the person does not yet have access.
Suspended	You have temporarily disabled the person's access.
Removed	You have revoked the person's access. Enter the Date Removed.

Keep removed users on the register with Status set to Removed until the next annual reauthorization.

Set Signed Form on File to Yes only after you have both the person's completed Authorization & Briefing form and signed Appointment Letter.

Section III: Tenant attestation

The tenant ISSM and Application Owner must sign the attestation to certify that:

The register lists every person with privileged access to the application.
Every active user has the required signed forms, current training, and DoDM 8140 qualification.
Every active user with IL4 or IL5 access is a U.S. person.
You do not store or transfer CUI, production data, or other IL4 or IL5 information in IL2 environments.
You will update and resubmit the register whenever you add or remove a user and review access at least quarterly.

Both signatories must use CAC/PIV digital signatures.

Note

Leave Section IV blank for Game Warden to complete during its review.

Submit your register¶

Log in to your Game Warden account.
In the left navigation bar, click Documents, then click New Document.
Choose your signed register from your device.
Enter a document name, such as Privileged User Register - <application name>. Optionally, select the application it is associated with.
Select the appropriate document category.
Click Upload.

Use the submission type you selected in the register to provide reason for this submission. See Upload Documents to Game Warden.

Do not upload Appointment Letters, Authorization & Briefing forms, or qualification evidence with the register. Keep these records on file and provide them to Game Warden on request.

Verify DoDM 8140.03 qualifications¶

Before granting privileged access, verify that each user meets the DoDM 8140.03 foundational qualification for their assigned work role. Game Warden applies the same requirement to its own platform privileged users. Users can meet the qualification requirement through an accepted certification, education, or training.

Record the following information for each user in the register:

DCWF work role code and proficiency level, for example, 451 / Intermediate
Qualification type: certification, education, or training
Credential name and expiration date, if applicable

Do not mark a user as Active if their qualification status is Not qualified. Keep qualification evidence current and available for Game Warden to review on request.

Verify citizenship requirements by IL¶

Check each privileged user's citizenship status against the highest IL environment they can access.

Highest environment accessed	Requirement
IL4 or IL5	The user must be a U.S. citizen, U.S. national, or U.S. person.
IL2 only	No citizenship requirement applies.

Apply this requirement based on the environment the user can access, not the application's IL. For example, a developer working on an IL5 application who can access only IL2 environments does not need to meet the IL4 or IL5 citizenship requirement.

Record the highest IL environment each user can access in the register.

A non-U.S. person may receive privileged access to an IL4 or IL5 environment only if the application's Authorizing Official provides written approval to Game Warden.

Important

Keep CUI, production data, and other IL4 or IL5 information out of IL2 environments.

Review privileged access quarterly¶

Review privileged access at least once every quarter to confirm that each user still needs access and meets the qualification requirements.

Confirm that each user still needs privileged access to perform their duties.
Verify that each user's required training and DoDM 8140 qualification remain current.
Revoke access that the user no longer needs, and update the register to reflect the change.
Update the Last Access Review date for each user you reviewed.
Upload the updated register with the submission type Quarterly review.

Once a year, upload the register with the submission type Annual reauthorization and obtain new attestation signatures from the tenant ISSM and Application Owner.

Remove a privileged user¶

Remove a privileged user's access when they leave the organization, change duties, or no longer need access.

Revoke the user's access.
Notify Game Warden promptly in accordance with Game Warden account management requirements.
Set the user's register Status to Removed and enter the Date Removed.
Upload the updated register with the submission type Change (add / remove user).

How Game Warden reviews your register¶

Game Warden compares your register with the platform's access records to verify that privileged access matches your documented users and requirements.

Game Warden treats the following as discrepancies:

A user has privileged access on the platform but does not appear on your register.
An Active user does not have a signed Authorization & Briefing form and Appointment Letter on file.
An Active user does not have a current DoDM 8140 qualification.
A user does not meet the citizenship requirement for the highest IL environment they can access.

Game Warden notifies you of any discrepancy and sets a follow-up date. Game Warden may suspend the user's privileged access until you provide the required documentation or resolve the discrepancy.

Troubleshooting¶

Game Warden suspended a user's privileged access.

Game Warden found a discrepancy during its review. Provide the missing form, letter, qualification evidence, or Authorizing Official approval, then upload the updated register.

I can't mark a user as Active.

The user has not yet met the DoDM 8140 qualification requirement, or their forms are incomplete. Keep the user as Pending until they meet the qualification requirement and you have both signed documents.

A user needs a different role or environment.

The Appointment Letter covers only the roles and environments you selected. Issue a new Appointment Letter, then update the register.

I have more than 42 privileged users.

The roster holds up to 42 users. Use another copy of the register for the remaining users.

For questions about these documents, or to request blank copies, contact your MSM.