Teleport's Access Request plugins authenticate to your Teleport cluster as a
user with permissions to list and read Access Requests. This way, plugins can
retrieve Access Requests from the Teleport Auth Service and present them to
reviewers.

Define a user and role called `access-plugin` by adding the following content to
a file called `access-plugin.yaml`:

```yaml
kind: role
version: v5
metadata:
  name: access-plugin
spec:
  allow:
    rules:
      - resources: ['access_request']
        verbs: ['list', 'read']
      - resources: ['access_plugin_data']
        verbs: ['update']
---
kind: user
metadata:
  name: access-plugin
spec:
  roles: ['access-plugin']
version: v2
```

Create the user and role:

```code
$ tctl create -f access-plugin.yaml
```

As with all Teleport users, the Teleport Auth Service authenticates the
`access-plugin` user by issuing short-lived TLS credentials. In this case, we
will need to request the credentials manually by *impersonating* the
`access-plugin` role and user.

<ScopedBlock scope={["oss", "enterprise"]}>If you are using `tctl` from the Auth
Service host, you will already have impersonation privileges.</ScopedBlock>

To grant your user impersonation privileges for `access-plugin`, define a role
called `access-plugin-impersonator` by pasting the following YAML document into
a file called `access-plugin-impersonator.yaml`:

```yaml
kind: role
version: v5
metadata:
  name: access-plugin-impersonator
spec:
  allow:
    impersonate:
      roles:
      - access-plugin
      users:
      - access-plugin
```

Create the `access-plugin-impersonator` role: 

```code
$ tctl create -f access-plugin-impersonator.yaml
```

(!docs/pages/includes/add-role-to-user.mdx role="access-plugin-impersonator"!)

You will now be able to generate signed certificates for the `access-plugin`
role and user.