> For the complete documentation index, see [llms.txt](https://docs.atomyx.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.atomyx.io/getting-started/shared-concepts/roles-and-access.md).

# Roles and Access

Atomyx uses layered access control.

Access is not managed through one single setting. Instead, it is built up through identity, workspace membership, and product-level permissions.

### The access model

A user typically needs all of the following:

1. an Atomyx account
2. membership in a workspace
3. access to one or more products in that workspace
4. the correct role at the relevant level

### Workspace-level access

Within a workspace, users are assigned a workspace role.

Typical workspace roles include:

* Owner
* Admin
* Member
* Billing

These roles determine what the user can do at the workspace level, such as managing users, products, groups, settings, or billing.

### Product-level access

A user may also need product-level access inside the workspace.

This is separate from the workspace role.

For example, a user may be:

* a Member at the workspace level
* an Admin within a specific product

### Group-based access

Groups help manage access at scale.

Instead of assigning every user individually, teams can assign groups to products and let group membership control access more efficiently.

### Why this matters

This model makes it possible to:

* give different levels of access in different workspaces
* separate billing from operational administration
* keep product access tightly controlled
* scale access management across larger teams

### Practical advice

Follow least-privilege principles:

* give users the minimum access they need
* use groups where possible
* review access regularly
* avoid assuming workspace membership alone is enough

### Related pages

* **Accounts**
* **Workspaces**
* **Products**
* **Users, Groups and Roles** in Vault
* **Authentication and API Keys** in Vault


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.atomyx.io/getting-started/shared-concepts/roles-and-access.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.