---
title: "Role Assignments"
description: "How a role is assigned to a principal or team within a scope, and how the assignment is evaluated."
canonical: "https://docs.cm.com/governance/guides/core-concepts/role-assignments"
---

# Role Assignments

> How a role is assigned to a principal or team within a scope, and how the assignment is evaluated.

Source: https://docs.cm.com/governance/guides/core-concepts/role-assignments

A **role assignment** is what actually gives someone access. It connects four things:

| Part | Meaning |
| - | - |
| **Principal** | Who gets the access: a user, a team or a product token. |
| **Role** | What they can do. |
| **Scope** | Where it applies: one account, or the whole organization. |
| **Resource** | Which resources it covers. Blank means all. |

For example: _the Support team_ gets _a read-only role_ in _the Sales account_ on _`/agents/*`_.

## How assignments are combined

Assignments only add access. A person's access is everything they are given directly, plus everything their teams are given. There is no assignment that takes access away.

## Changing and removing

- You cannot edit the principal or the scope of an assignment. To move it, remove it and create a new one.
- Removing an assignment deletes it. Every change is recorded in the change log.
- The same combination of principal, role, scope and resource can exist only once.

## Related

- [Principals](https://docs.cm.com/governance/guides/core-concepts/principals)
- [Roles](https://docs.cm.com/governance/guides/core-concepts/roles)
- [Accounts and organizations](https://docs.cm.com/governance/guides/core-concepts/accounts-and-organizations)
- [Resources](https://docs.cm.com/governance/guides/core-concepts/resources)
- [How access decisions work](https://docs.cm.com/governance/guides/how-access-decisions-work)