---
title: "Access control overview"
description: "Manage workspace access with Alpacon IAM. Use roles, user accounts, and groups to decide who can reach registered resources and which actions they can take."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# Access control overview

Manage who can access workspace resources through Alpacon IAM.

## What is IAM?

Alpacon's IAM (Identity and Access Management) lets administrators manage **access control** for resources registered in a workspace through user identities, roles, and permissions. Whether you're managing cloud servers, on-premise machines, or hybrid environments, IAM applies the same access controls.

**Key benefits:**
- Centralized user and group management
- Role-based access control (RBAC)
- Granular permissions for servers and resources
- Audit trails for security compliance

## Core components

### Users

Manage individual users who have access to workspace resources. Each user receives permissions through assigned **roles** or **groups**.

**User roles:**
- **User**: Access assigned servers, edit own profile
- **Staff**: Manage users/groups, some workspace settings
- **Superuser**: All permissions, full workspace control

**What you can do:**
- [Invite and register new users](/use/iam/users/add/)
- [Assign roles to each user](/use/iam/users/manage/)
- [Activate or deactivate user accounts](/use/iam/users/remove/)

### Groups

Organize users into **groups** based on shared responsibilities or access levels. Groups make it easy to manage permissions for multiple users at once.

**Group features:**
- Group-based server access control
- Multiple group membership per user
- Role hierarchy within groups (Owner, Manager, Member)

**What you can do:**
- [Create and edit groups](/use/iam/groups/create/)
- [Add or remove users from groups](/use/iam/groups/assign-users/)
- [Configure group-level permissions](/use/iam/groups/set-permissions/)

### Permissions

Control access to servers and features through a two-level permission model:

1. **Workspace-level roles**: User, Staff, Superuser
2. **Server-level access**: Group-based assignments

Learn more: [Set permissions](/use/workspace/settings/roles/)

### API tokens

Create API tokens for programmatic access to Alpacon API without user passwords.

**Use cases:**
- Automation scripts
- Third-party integrations

CI/CD pipelines and other unattended automation run on service tokens issued to an [application](/use/iam/applications/).

Learn more: [API tokens](/use/settings/api-tokens/)

### Applications

Manage **non-human identities**—CI/CD pipelines, monitoring, automation, and AI agents—as their own entities, and issue them [service tokens](/use/iam/applications/service-tokens/) with scoped, risk-assessed, audited access. Applications are an administrator-only feature.

Learn more: [Applications](/use/iam/applications/)

## How IAM works

### Access control flow

1. **User invited** → Receives workspace access
2. **Role assigned** → Determines workspace permissions
3. **Added to groups** → Gains server access
4. **Permissions applied** → Can access assigned servers

### Permission inheritance

- Users inherit permissions from their workspace role
- Additional access granted through group membership
- Superusers and Staff access all servers without group assignment
- Users only access servers assigned to their groups

## Security best practices

**Principle of least privilege:**
- Grant minimum required permissions
- Regularly review and adjust permissions

**Use groups:**
- Manage permissions via groups rather than individual users
- Separate groups by environment, project, or role

**Limit Superusers:**
- Keep Superuser role to minimum
- Grant only to trusted administrators

**Regular audits:**
- Review user access regularly
- Remove inactive users promptly
- Monitor access logs for suspicious activity

## Getting started

### For administrators

1. [Invite team members](/use/iam/users/add/)
2. [Create groups](/use/iam/groups/create/) for different teams or projects
3. [Assign users to groups](/use/iam/groups/assign-users/)
4. [Configure server access](/use/workspace/settings/roles/)

### For automation

1. [Create an application](/use/iam/applications/) for the pipeline or job
2. [Issue it a service token](/use/iam/applications/service-tokens/) and add its ACL rules
3. Monitor token usage regularly

## Related docs

- [Manage users](/use/iam/users/manage/)
- [Manage groups](/use/iam/groups/manage/)
- [Set permissions](/use/workspace/settings/roles/)
- [API tokens](/use/settings/api-tokens/)

Source: https://docs.alpacax.com/use/iam/