Role Assignments
A role assignment is what actually gives someone access. It connects four things:
| Part | Meaning |
|---|---|
| Principal | Who gets the access: a user, a team or a product token. |
| Role | What they can do. |
| Scope | Where it applies: one account, or the whole organization. |
| Resource | Which resources it covers. Blank means all. |
For example: the Support team gets a read-only role in the Sales account on /agents/*.
How assignments are combined
Assignments only add access. A person's access is everything they are given directly, plus everything their teams are given. There is no assignment that takes access away.
Changing and removing
- You cannot edit the principal or the scope of an assignment. To move it, remove it and create a new one.
- Removing an assignment deletes it. Every change is recorded in the change log.
- The same combination of principal, role, scope and resource can exist only once.