---
title: "Scenario: Halo"
description: "A worked example of how Governance controls access in Halo."
canonical: "https://docs.cm.com/governance/guides/scenarios-halo"
---

# Scenario: Halo

> A worked example of how Governance controls access in Halo.

Source: https://docs.cm.com/governance/guides/scenarios-halo

Halo contains profiles and agents. Not everyone in an organization needs the same level of access to them. This example shows how Governance handles that.

## The goal

| Group | Should be able to |
| - | - |
| **Integration Specialists** | Configure specific agents. |
| **Support** | View how agents behave. |
| **Developers** | Manage everything. |

## The setup

1. **Create a team for each group.** See [Teams](https://docs.cm.com/governance/guides/core-concepts/teams).
2. **Add users to the teams.**
3. **Assign a role to each team on the resources it needs.** A resource can be a whole profile, or one agent in it, such as the Weather Agent in Hugo's profile. See [Resources](https://docs.cm.com/governance/guides/core-concepts/resources).
4. **Give individual access only where needed.** A single person can also be assigned a role directly, outside any team.

## What happens next

When someone uses Halo, Governance checks their access:

- A Support user who tries to configure the Weather Agent is **denied**.
- An Integration Specialist who configures it is **allowed**.
- A user added to the Developers team can manage everything straight away.

Access is checked on each resource, not just on Halo as a whole.

## Related

- [How access decisions work](https://docs.cm.com/governance/guides/how-access-decisions-work)
- [Role assignments](https://docs.cm.com/governance/guides/core-concepts/role-assignments)