Accounts and Organizations
Access in Governance always applies within a scope. There are two scopes:
- Organization: your company as a whole.
- Account: one workspace inside your organization.
One organization owns one or more accounts.
Choosing a scope
| Assigned at | Applies to |
|---|---|
| Account | That account only. |
| Organization | Every account in the organization. |
Most roles are assigned at account level. Only the Platform Owner role is normally assigned at organization level.
How the two scopes combine
When Governance checks access in an account, it looks at the grants made on that account and the grants made on its organization. Both count.
The reverse is not true. A check at organization level looks at organization grants only, so an account-level grant never gives access to the whole organization.
Common mistake
An organization-level assignment is not limited to one account. If someone should only work in one account, assign their role at that account.