> ## Documentation Index
> Fetch the complete documentation index at: https://docs.groundforge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access

> Manage people, non-human identities, roles, and assignments.

GroundForge access is built from three simple building blocks: identities, Roles, and Assignments.

## Users

A User represents a person. Users are normally invited or created with an email address, and they receive access through direct or Group-based Assignments.

## Groups

A Group collects Users who need the same access. Use Groups for teams such as Agent operators, reviewers, or Workspace administrators, instead of repeating the same Assignment for each person one at a time.

## Service Accounts

A Service Account is a non-human identity used by Agents, automation, and integrations. Give each workload its own Service Account, so its credentials can be scoped, audited, and revoked independently of every other workload.

## Roles

A Role defines permissions, the principal types it can be assigned to, and the resource scopes where it applies. Built-in Roles are read-only. When you create a custom Role, include only the permissions actually required for the job it's meant to do.

## Assignments

An Assignment binds a Role to a User, Group, or Service Account at a selected scope. Prefer Workspace scope unless Organization-wide administration is genuinely required.

## CLI examples

```bash theme={null}
gforge users list
gforge groups list
gforge service-accounts list
gforge roles list
gforge assignments list
```

Review Assignments regularly and archive identities that are no longer in use — it's a small habit that keeps access tidy. Continue with [Credentials](/administration/credentials).

Related: [Identity and access](/concepts/identity).


## Related topics

- [Identity and Access](/concepts/identity.md)
- [Organizations and Workspaces](/concepts/scope.md)
- [Security](/help/security.md)
- [Workspaces](/administration/workspaces.md)