> For the complete documentation index, see [llms.txt](https://docs.infraglide.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.infraglide.com/settings-governance-and-rbac/rbac.md).

# Role-Based Access Control (RBAC)

## Role-Based Access Control (RBAC)

RBAC controls who can view or change Workspaces, Sandboxes, pipelines, credentials, and admin modules.

### ![alt text](/files/XV5yYVrzGY7hrTJ0bWLH)

### Built-in Roles

Seeded role names:

| Role        | Typical use                                                |
| ----------- | ---------------------------------------------------------- |
| `org_admin` | Full organization administration                           |
| `Admin`     | Admin within the grant’s scope (org / workspace / sandbox) |
| `Editor`    | Create and edit pipelines and related resources            |
| `Viewer`    | Read-only access                                           |

![alt text](/files/36raz78kswFLRBAvw15c)

Permissions are generally related to the various modules and have actions such as shaped as such as **`view`**, **`edit`**, and **`manage`** across modules (Dashboard, My Pipelines, Architecture, Credentials, Hub, Deployed Resources, RBAC Management, Manage Users, Settings, and others).

![alt text](/files/h9n3aqedSSJDH02CstDx)

![alt text](/files/kP38ZgAx4IItqT223okQ)

![alt text](/files/UveNyIdMo4WDV36KSR11)

My Pipelines maps Terraform actions to permissions (for example destroy requires `manage`, plan/apply require `edit`).

***

### Creating custom roles

* Click on "Create role" to create your own custom role.
* Provide the details of your custom role like Role Name, Description.

![alt text](/files/DE7dYQKSgSTchOpwqcBd)

* Give the required permissions or you can import the permissions form various exisitng roles also.

![alt text](/files/q98TzDLzuoLK3b0xVHju)

***

### Groups

* **Group Management** allows you to create and maintain groups of users for easier access and permission management.
* The **Groups** section displays all groups available
* Use **Search groups** to quickly locate a specific group.
* Use **Filter Groups By Creator** to view groups created by a particular user.

![alt text](/files/veCyXLqSjIlDDBVUowes)

#### Creating a Group

* Click Create Group.
* Enter the group details, including the group name and an optional description, access grant , role.
* Save the group by hitting "Create Group".

![alt text](/files/elfqgkAxd6SsJr81Bmx0)

* The newly created group appears in the Groups list.

![alt text](/files/Hebpdcf54UMaQZZYI26i)

* Group owners can use the available Edit and Delete actions to manage the group.

#### Adding members

* Click Add Members to add users to the group.

![alt text](/files/VxnejJkhMhNUuIlvkGjI)

* Select the users (single or multiple) to add to the particular group.

![alt text](/files/OXvzSeYQoXN3ADJtdZV9)

***

### Access Control

* Assign access roles dynamically scoped to Organization, Folder, or Project levels.

![alt text](/files/oS4BuTOMAGRFdOTNUKUu)

#### Grant Access

* Assign a role to users or groups for a specific resource.
* Click "Grant Access".

![alt text](/files/fznQLoLyhBtqeEGw8Wji)

* Provide the details such as - Principals, Role, Resource Level, Select Workspace.

![alt text](/files/PPXQp0ljr7EOuGRQMrdO)

* Roles

![alt text](/files/SThfuKKgRIRa2lAAzhIh)

* Resource Level

![alt text](/files/qDrciffxQF8VTFWpXTyE)

* Select Workspace

![alt text](/files/rWsIFKkzlfAcYzBiVGQr)

***

### People Access

* You can monitor the information of the members under your scope as well as the users with equal scope and rights as you have.

![alt text](/files/XLtAtVHF2lggirlggavc)

***

### Activity Log

* Audit trail logging grants, revocations, and configuration changes within your organization context.

![alt text](/files/e5GgNdKIKUoooJQJ3wPf)

***

### Where Admins Configure RBAC

* **RBAC Management** / **Roles** pages — define and assign roles
* **Manage Users** — invitations and account status management
* **Access Explorer** / **User Access Report** — inspection of team permissions

***

### Practical Patterns

* Give most builders **Editor** on a Sandbox, not org-wide Admin.
* Use **Viewer** for auditors on production Sandboxes.
* Keep credential `manage` tightly scoped — credentials unlock Deploy.
* After changing grants, ask users to refresh; empty Workspace lists redirect to no-access.

***

### See also

* [User Management & Invitations](/settings-governance-and-rbac/user-management.md)
* [Cloud Credentials Management](/settings-governance-and-rbac/cloud-credentials.md)
* [Organization & Workspace Administration](/settings-governance-and-rbac/organization-settings.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.infraglide.com/settings-governance-and-rbac/rbac.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.