# Attach evidence to a manual access record
URL: https://docs.autociso.io/product/access/manual-access-evidence/
Description: Add a proof file (screenshot, PDF, CSV or spreadsheet) to an access record you entered by hand, download it later, replace it, or remove it.

Some access can't be imported: a shared admin login, a system with no export, a
contractor's account. You record it by hand as a manual access record. Attaching
a file, such as a screenshot of the admin console, gives your auditor proof to
open later.

## Add a record with evidence

1. Open **Operations → [Access Audit](https://docs.autociso.io/console/access/access-audit/)** and click **Add Manually**.
2. In **Add Manual Access**, choose the **Employee**, the **Asset**, the **Role in Asset** and the **Identity Type** (**Human** or **Service Account**).
3. Under **Evidence (optional)**, choose your file. The hint reads "PDF, image, CSV or XLSX, up to 10 MB".
4. Click **Add Access**.

Accepted files are PDF, PNG, JPEG, GIF, WebP, CSV and XLSX, up to 10 MB. SVG
images and older `.xls` spreadsheets are rejected, and so is anything larger than
10 MB. The dialog stays open with a message, so you can pick a different file.

## Find and download the file

The **Evidence** column shows the file name for records that have one, and a dash
for those that don't. It appears in two places:

- **Operations → Access Audit**, in the manual access table.
- **Access & Risk → [Access Inventory](https://docs.autociso.io/console/access/inventory/)**.

Click the file name to download it. Anyone who can view the Access Inventory can
download evidence, so an auditor with read access doesn't need an admin to fetch
it.

## Replace or remove evidence

- **Replace:** add the same employee and asset again with a new file. The new file replaces the old one. If you add the record again without a file, the existing file stays.
- **Remove:** in the manual access table, click the trash icon (**Remove evidence**) next to the file name and confirm. Only the file is removed; the access record stays. This is available to Owners and Managers (see [roles and permissions](https://docs.autociso.io/getting-started/roles-and-permissions/)).

## Good to know

- Uploads, downloads and removals are recorded in the [audit trail](https://docs.autociso.io/console/settings/audit-trail/).
- A CSV file opened in a spreadsheet app can contain formulas. Open files only from sources you trust.
- Removing evidence or replacing it doesn't change the access record itself.