# Users, Groups, and Roles

> Manage direct and inherited organisation access with members, groups, and roles.

Users are invited into organisations. IAM roles define what a user or service account can do, while groups make the same role access easy to apply to several identities.

For basic organisation administration, start with [Members and Invitations](/docs/infuse-cloud/members-and-invitations) and [Member Roles](/docs/infuse-cloud/member-roles).

## Users

A user is a person who can sign in to Infuse and access one or more organisations.

Open **Access management** > **Members** to manage active members. Invitations are in the **Invitations** view within Members.

Each member has exactly one baseline membership level: **Owner**, **Admin**, or **Member**. A member can also receive any number of additional compatible IAM roles directly or through groups. These sources are cumulative.

Select **Manage access** or **View access** beside a member to open their detail page. Its **Access** view shows:

- the member's baseline membership level,
- additional roles assigned directly,
- direct permission grants,
- roles inherited through groups,
- current effective permissions and the source of each permission.

Owners and administrators can change eligible membership levels from this page. Only owners can assign or remove the Owner level.

The member's **API keys** view shows metadata for personal API keys. Members issue their own keys from the user menu > **API keys**; authorised administrators can inspect or revoke a key but cannot reveal or issue it for someone else.

## Groups

Groups collect users and service accounts so access can be managed in one place.

Use groups when:

- multiple people or workloads need the same access,
- a team or set of integrations changes often,
- you want to remove or add access without editing each identity,
- you need a consistent access pattern across product workflows.

### Create a Group

1. Open **Access management** > **Groups**.
2. Select **Create group**.
3. Enter a group name.
4. Add an optional description.
5. Select the users and service accounts that should belong to the group.
6. Save the group.

The group belongs to the active organisation. If you switch organisations, the groups list changes to that organisation.

### Manage Group Membership and Roles

Open **Access management** > **Groups**, then select the group. The group page has separate **Members** and **Assigned roles** views.

From **Members**, update the name, description, or selected identities. Before saving, the Portal shows how many will be added or removed and warns when the change affects inherited access. An identity cannot be added if it is incompatible with a role already assigned to the group.

From **Assigned roles**, select **Assign role**, choose a compatible organisation role, and confirm the assignment. Every current member inherits the role immediately, and compatible members added later inherit it automatically. Save or discard pending membership changes before assigning another role.

To remove inherited access, revoke the role from the group. To retire the group, delete it from the groups list. The Portal warns when deleting a group will remove inherited role access from its members.

## Roles

Roles describe what a user or service account can do. A role contains one or more permissions and declares which principal types can receive it. A role can also limit compatible permissions to particular resources and require time-based conditions.

Use **Access management** > **Roles** to review roles available to the active organisation. The list labels each role as an **Organisation role**, a **Shared template** provided by Infuse, or a read-only **System role**, and shows its permission count and supported principal kinds. System roles are managed by Infuse and cannot be opened or assigned from your organisation.

### Review a Role

Open a role to see:

- an overview, including its type, scope, and which principal kinds it can be assigned to,
- permissions and any resource limits,
- direct identity and group assignments,
- conditions that must match before the role grants access.

Use the assignment filters to separate directly assigned members from groups. Group assignments display how many current members inherit the role.

### Create or Clone a Role

Select **Create role** from **Access management** > **Roles** to create a role owned by the active organisation. Enter a name and optional description, choose at least one applicable principal kind, select permissions, and add any required resource limits or conditions.

Infuse-provided shared templates are read-only. Open a template and select **Clone** to create an editable organisation-owned copy with the same permissions, resource limits, conditions, and principal types.

### Edit or Delete an Organisation Role

Open an organisation-owned role and select **Edit**. You can change its name, description, principal types, permissions, resource limits, and conditions. The Portal warns when a change may remove or broaden existing access.

Deleting an organisation role stops its existing assignments from granting access. Shared templates cannot be edited or deleted.

### Assign and Revoke Roles

Where you assign a role depends on who should receive it:

<table>
<thead>
  <tr>
    <th>
      Assign to
    </th>
    
    <th>
      Where
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Members
    </td>
    
    <td>
      The role page, or the member's <strong>
        Access
      </strong>
      
       view
    </td>
  </tr>
  
  <tr>
    <td>
      Service accounts
    </td>
    
    <td>
      The service account's <strong>
        Access
      </strong>
      
       tab
    </td>
  </tr>
  
  <tr>
    <td>
      Groups
    </td>
    
    <td>
      The group's <strong>
        Assigned roles
      </strong>
      
       view
    </td>
  </tr>
</tbody>
</table>

To assign a role to members from the role page:

1. Open **Access management** > **Roles**.
2. Open the role.
3. Select **Assign role**.
4. Choose one or more organisation members.
5. Select **Assign**.

The role must support the **User** principal kind to be assigned to members. You can assign organisation roles and shared templates; you do not need to clone a template first unless you want to customise it.

The role's **Role assignments** view lists direct member assignments and group assignments. Use **All**, **Members**, and **Groups** to filter the list.

Revoke a direct assignment from the identity's page or from the role's **Role assignments** view. Revoking a group assignment removes that inherited role from every current group member; it does not remove those identities from the group.

## Check Effective Access

Open a member or service account and select its **Access** view. **Effective permissions** is the current access result. The **Direct roles**, **Group-inherited roles**, and **Direct grants** sections explain where each permission comes from. The view also shows the identity's status and expiry, and a **Credentials** summary of its API-key state.

An assignment can appear in a source list without producing a current effective permission, for example when it has not started, has expired, has an unmet condition, or is limited to another resource.