> ## Documentation Index
> Fetch the complete documentation index at: https://docs.khal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# What access means for an FDE

> Access is a real cloud workstation, not a login.

FDE "access" isn't a dashboard account — it's `ssh` into your own full-sudo Ubuntu workstation on KHAL infrastructure. This page is the map; the two role guides are the runbooks.

<Note>
  Every command is the `khal fde` CLI (from `app-kit`), always talking to `platform.khal.ai`. `--target` is an **environment label** (`dev`, `hml`, `prod`), never a URL.
</Note>

## Two roles, one flow

* **Admin/superadmin** — mints your invite, later approves your SSH lease.
* **You (engineer)** — redeem the invite, request the workstation, connect.

No shortcuts: no workstation without an invite, no SSH without an approval.

## The flow

<Steps>
  <Step title="Admin mints an invite">A single-use code that bootstraps your identity.</Step>
  <Step title="You enroll">Redeem it and hand over your SSH public key — `khal fde enroll`.</Step>
  <Step title="You request a workstation">`khal fde instance` provisions a real VM — cloned, booted, on Tailscale.</Step>
  <Step title="Admin approves">The workstation exists, but the SSH lease stays gated until approved.</Step>
  <Step title="You connect">`khal fde ssh`. Check `khal fde status` anytime.</Step>
</Steps>

## Before you start

Install the `khal` CLI — see [Install your FDE toolchain](/fde-engineer/khal-cli).

## Pick your role

<CardGroup cols={2}>
  <Card title="I'm the admin" icon="user-shield" href="/fde-start-here/access/admin-guide">
    Mint an invite, then approve the workstation.
  </Card>

  <Card title="I'm the new engineer" icon="terminal" href="/fde-start-here/access/engineer-guide">
    Redeem, request, connect.
  </Card>
</CardGroup>

Stuck? [Access troubleshooting](/fde-start-here/access/troubleshooting).

<Accordion title="🤖 Agent paste prompt">
  ```text theme={null}
  TASK: Use `fde-start-here/access/overview.mdx` to orient a new FDE or admin, then hand off to the role-specific guide before running anything.
  CONTEXT: Orientation page, not a runbook — commands live in the admin and engineer guides it links to.
  SAFE FIRST COMMANDS: `khal fde status`, `khal --version` (neither mutates).
  EVIDENCE: Confirm the role (admin or engineer) before recommending a command, then follow that page's own agent prompt.
  ```
</Accordion>