Session Target Folders
Folders organize session targets on the users' Sessions page. You build one folder tree for your tenant, for example by team, site or application, and file your RDP and SSH targets into it. Users then browse that tree to find a target instead of scrolling through every target they can reach. How users work with folders is described in Remote Sessions.
This page also covers the Terminal section of an SSH target, where you set the font, text size and color scheme an SSH session starts with.
Folders grant nothing
A folder is display structure only. Putting a target in a folder, moving it, or deleting a folder never gives or takes away access, and never affects a running session. Access to a target still comes from the roles that grant it.
The Folders Tab
You manage folders under Admin → Sessions → Folders. You need tenant admin rights.
The tab lists the whole tree, indented by level. For each folder you see:
- Targets: the targets directly in the folder.
- With subfolders: the targets in the folder and in all its subfolders, with RDP and SSH links that open those tabs filtered to this folder.
- Actions: Edit folder, New subfolder and Delete.
Above the table, a line shows how many targets are in no folder, again with RDP and SSH links to them.
Limits
Folders nest up to three levels deep, for example Operations › SAP › Production. A tenant holds up to 500 folders. A folder name can be up to 100 characters and must be unique among its sibling folders, ignoring case. A name cannot contain /, which separates folder paths, or control and invisible characters. A top-level folder cannot be named unassigned, because that word means "no folder".
Create, Rename and Move Folders
To create a top-level folder, click New folder. To create a folder inside another one, click New subfolder on that folder's row. In the dialog, enter a Name, check the Parent folder (Top level for none), and click Create Folder.
To rename a folder or move it under another parent, click Edit folder on its row, change the name or the parent folder, and click Save Folder. A folder moves together with its subfolders and the targets in them. The Parent folder list offers only parents that keep the tree within three levels, and never the folder itself or one of its own subfolders.
Folders Flagged with a Problem
When two admins change the tree at the same moment, a folder can end up with a parent that no longer exists, with a parent chain that loops back to itself, or deeper than three levels. GrantFlow then shows the folder at the top level with a badge: Parent missing, Cycle or Too deep. To fix it, open Edit folder, choose a valid parent folder, or leave Top level, and save.
Delete a Folder
Click Delete on a folder's row and confirm. Only an empty folder can be deleted: if the folder still holds subfolders or targets directly in it, GrantFlow refuses and tells you what to move first, for example Empty the folder first: 2 subfolders, 5 session targets. Move the targets to another folder or to Unassigned, and delete or move the subfolders, then try again.
Assign Targets to Folders
A target sits in at most one folder. A target in no folder is Unassigned, and users find it under Unassigned or All targets. There are three ways to file targets:
- One target: under Admin → Sessions → RDP or SSH, edit a target and choose its Folder in the Connection section.
- Many targets at once: on the RDP or SSH tab, select targets with the checkboxes, then click Move to folder… in the bar that appears. Choose a folder or Unassigned, and confirm with the Move button.
- On import: in the import dialog, choose a Folder. Every imported host goes into it. A host that the import skips because it already exists keeps its current folder.
The selection on the RDP and SSH tabs stays while you page through the list, so one move can cover targets from several pages. The checkbox in the table header selects only the targets on the current page. Changing a filter or the search clears the selection, so a move never includes targets you can no longer see.
GrantFlow moves large selections in batches of 500 targets. Each batch is saved on its own, so if one fails, the batches before it stay moved and only the remaining targets stay selected for a retry.
Filter Targets by Folder
The RDP and SSH tabs have a folder filter and a Folder column. Choosing a folder shows the targets in it and in its subfolders. Choose Unassigned to find targets that are not filed yet.
What Users See
Each user sees a version of the tree trimmed to their own access. A folder appears only when it, or one of its subfolders, holds a target the user can reach, and its count includes only those targets. A user never learns from a folder name or a count that targets exist which they cannot reach.
A new folder is invisible until it holds a reachable target
An empty folder, or one whose targets no role grants to a user, does not appear on that user's Sessions page. If users report a missing folder, check that the folder holds targets their roles grant.
SSH Terminal Defaults
When you edit an SSH target, the Terminal section sets how its sessions start:
| Field | Values |
|---|---|
| Font | Not set, or one of the fonts the session menu offers: DejaVu Sans Mono, JetBrains Mono, Source Code Pro, Hack, Inconsolata, Liberation Mono |
| Text size | 6 to 48 points. Empty uses the default of 12 |
| Colour scheme | Not set, or one of the session menu's schemes, such as Grey on black, GrantFlow dark or Solarized light |
Not set leaves the choice to the session's built-in default. A font or color palette that was set for the target through the API, and that the list does not offer, is shown as such and kept when you save.
Users can change the font, text size and color scheme during a session from the Appearance menu in the session bar. GrantFlow saves that choice for the user in their browser, and it applies to every SSH target they open there, ahead of your defaults. Reset to target default in that menu returns to the values you set here and forgets the saved choice. If a user reports that your defaults do not show, ask them to use it.
A stored value the session cannot use blocks the next save
GrantFlow now checks the terminal values when you save an SSH target. If a target already stores a font, size or palette that a session would refuse, its next save fails with a message that names the field. Clear or change that value to save the target. Sessions never applied such a value anyway.
Audit Events
Folder and move actions are recorded in the audit log:
| Event | When |
|---|---|
| Folder Created | A folder was created, with its name and path. |
| Folder Updated | A folder was renamed or moved, with the old and new path. |
| Folder Deleted | A folder was deleted. A delete that was refused because the folder was not empty is recorded too, as a failure, with what blocked it. |
| Targets Moved to Folder | Targets were moved with Move to folder… or through MCP, with each target's previous folder, so every move can be reversed. |
Setting a target's folder in the target dialog is recorded as Target Created or Target Updated, and an import into a folder as Target Imported. Favorites and recently used targets are private display state for each user and create no audit events.
MCP Tools
AI assistants connected through the GrantFlow MCP server can manage folders as a tenant admin. session_folder_list, session_folder_create, session_folder_update and session_folder_delete work on the tree, and refer to folders by path, such as Operations/SAP, or by ID. session_target_set_folder moves up to 100 targets in one call, and moves none if one of them cannot be matched. session_target_list and session_target_add take a folder as well. Favorites and recently used targets have no MCP tool.
The same server can also set up session access: session_zone_create creates a zone, session_target_add adds targets to it, and role_update grants or removes session targets through a role. A change to a role's session targets always shows a preview first. Removing a target from a role ends the live sessions opened through that role.