---
title: "What Governance Does Not Do"
description: "The boundaries of Governance: what it leaves to authentication and to individual applications."
canonical: "https://docs.cm.com/governance/guides/what-governance-does-not-do"
---

# What Governance Does Not Do

> The boundaries of Governance: what it leaves to authentication and to individual applications.

Source: https://docs.cm.com/governance/guides/what-governance-does-not-do

Governance answers one question: _is this person allowed to do this?_ It enforces access. It does not do the other jobs around it.

| Governance does not… | Who does |
| - | - |
| **Log people in.** It does not check passwords or sign-ins. | CM.com sign-in (single sign-on). Governance receives the identity after the person has logged in. |
| **Create users.** It copies user details from CM.com Platform. | CM.com Platform. |
| **Create API keys.** It registers existing keys as [product tokens](https://docs.cm.com/governance/guides/core-concepts/principals). | CM.com Platform. |
| **Store application data.** It holds no business data such as messages, contacts or reports. | The application. |
| **Decide what an application's permissions are.** It stores and checks them. | The application's team. |

## What this means in practice

- A person who can't log in has a sign-in problem, not an access problem.
- If a permission is missing from the list of choices, the application has not defined it.
- Governance tells an application "allow" or "deny". The application carries it out.

## Related

- [What is Governance?](https://docs.cm.com/governance/guides/what-is-governance)
- [How access decisions work](https://docs.cm.com/governance/guides/how-access-decisions-work)