---
title: "Accounts and Organizations"
description: "How accounts and organizations define the scope in which a role applies."
canonical: "https://docs.cm.com/governance/guides/core-concepts/accounts-and-organizations"
---

# Accounts and Organizations

> How accounts and organizations define the scope in which a role applies.

Source: https://docs.cm.com/governance/guides/core-concepts/accounts-and-organizations

Access in Governance always applies within a **scope**. There are two scopes:

- **Organization**: your company as a whole.
- **Account**: one workspace inside your organization.

One organization owns one or more accounts.

## Choosing a scope

| Assigned at | Applies to |
| - | - |
| **Account** | That account only. |
| **Organization** | Every account in the organization. |

Most roles are assigned at account level. Only the **Platform Owner** role is normally assigned at organization level.

## How the two scopes combine

When Governance checks access in an account, it looks at the grants made on that account **and** the grants made on its organization. Both count.

The reverse is not true. A check at organization level looks at organization grants only, so an account-level grant never gives access to the whole organization.

## Common mistake

An organization-level assignment is not limited to one account. If someone should only work in one account, assign their role at that account.

## Related

- [Principals](https://docs.cm.com/governance/guides/core-concepts/principals)
- [Role assignments](https://docs.cm.com/governance/guides/core-concepts/role-assignments)
- [How access decisions work](https://docs.cm.com/governance/guides/how-access-decisions-work)