> ## Documentation Index
> Fetch the complete documentation index at: https://docs.groundforge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Access

> Understand users, groups, service accounts, roles, and assignments.

GroundForge separates human users from non-human runtime identities.

| Resource        | Example                                                                 |
| --------------- | ----------------------------------------------------------------------- |
| User            | An administrator who creates Gateways and reviews Operator Tasks        |
| Group           | `support-operators` containing several users                            |
| Service Account | `support-agent-runtime` used by a managed Agent                         |
| Role            | A named set of permissions such as viewing Traces or reviewing tasks    |
| Assignment      | A Role granted to a user, group, or Service Account at a scope          |
| Credential      | A secret or API key issued to a specific runtime subject or integration |

Example: assign a Trace-viewer role to the `support-operators` group in the Support Workspace. Members can inspect requests there without receiving access to the Finance Workspace.

Use a separate Service Account and credential for each Agent or integration. This makes access easier to revoke and activity easier to attribute.

See [Access](/administration/access) and [Credentials](/administration/credentials).

## Example

The LangChain weather Agent should use its own Service Account and Agent-targeted credential. See [LangChain Agent Example](/examples/langchain-agent).


## Related topics

- [Access](/administration/access.md)
- [Credentials](/administration/credentials.md)
- [CLI Overview](/cli/overview.md)
- [Platform Overview](/platform/overview.md)