Identity and Access

GroundForge separates human users from non-human runtime identities.

Resource	Example
User	An administrator who creates Gateways and reviews Operator Tasks
Group	`support-operators` containing several users
Service Account	`support-agent-runtime` used by a managed Agent
Role	A named set of permissions such as viewing Traces or reviewing tasks
Assignment	A Role granted to a user, group, or Service Account at a scope
Credential	A secret or API key issued to a specific runtime subject or integration

Example: assign a Trace-viewer role to the support-operators group in the Support Workspace. Members can inspect requests there without receiving access to the Finance Workspace. Use a separate Service Account and credential for each Agent or integration. This makes access easier to revoke and activity easier to attribute. See Access and Credentials.

Example

The LangChain weather Agent should use its own Service Account and Agent-targeted credential. See LangChain Agent Example.

Overview

Concepts

Examples

Platform

SDK

CLI

REST APIs

Operations

Reference

Example

​Example

Example