> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt
> Use this file to discover all available pages before exploring further.
# IAM Concepts
> Users, groups, resources, permissions, roles, and conditions.
This page explains the **conceptual foundation** of IAM. To manage these concepts in practice, use the [Admin Portal](/user-docs/admin/overview).
## Identities
Email-based ARMS accounts. Access is granted through roles on resources across ARMS products (e.g., inventory, transload, intermodal, mobile).
| | Username | Identifier |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------------------------------------------------- |
| 
| Mike | user:[mike@cedx.rail](mailto:mike@cedx.rail) |
| 
| Kacey | user:[kecey@cedx.rail](mailto:kecey@cedx.rail) |
| 
| Heather | user:[heather@monstersugar.net](mailto:heather@monstersugar.net) |
| 
| Bob | user:[bob@monstersugar.net](mailto:bob@monstersugar.net) |
Organize users and assign access at scale across multiple ARMS modules.
| | Group | Identifier | Description |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------ |
| | CEDX Admin | group:cedxadmin | Has access to everything in the ARMS system that belongs to CEDX |
| | CEDX User | group:cedxuser | Conditionally allowed to access some parts of the system |
| | CEDX Customer Admin | group:cedxcustomeradmin | Can access customer tracks and certain groups, load and unload cars on customer tracks, and print paperworks |
| | CEDX Customer User | group:cedxcustomeruser | Can only print paperworks |
These are example resources used in this guide. Replace with your own organization’s resources (e.g., sites, terminals, customers, or operators).
## Resources
Equipment, groups, waybills, sites, terminals, operators, workflows, and more. Permissions can be granted at an organization/site/operator level, at a sub‑area (e.g., terminal or group/track), or at an individual resource level.
### Resource hierarchy and inheritance
Permissions granted at a higher‑level resource are inherited by child resources.
* Organization / Operator / Site → applies to all sub‑resources below
* Terminal / Group / Track → applies to resources in that sub‑area only
* Specific resource → applies only to that one resource
## Permissions and roles
* Permissions: `service.resource.verb` (e.g., `inventorymanagement.equipment.list`)
* Roles: collections of permissions
* Predefined roles (curated)
* [Feature sets](/user-docs/iam/feature-sets) — the columns of the Admin Portal IAM matrix; Cedar keeps each one current as features grow, so roles built on them don't drift
* Custom roles (tailored — best built by checking feature-set columns rather than picking individual permissions)
## How IAM works
Policies attach to resources and bind members to roles, with optional conditions. On access, ARMS evaluates the target resource’s policy to allow or deny—consistently across all ARMS modules.
Policy = Bindings of `{ role, members, optional condition }`. Conditions use a simplified CEL expression syntax.
## Conditions (optional)
Scope access by attributes. Examples:
```json theme={null}
{
"description": "Only BNSF cars",
"expression": "resource.equipmentInitial == 'BNSF'"
}
```
```json theme={null}
{
"description": "Tracks A or B",
"expression": "resource.track in ['A','B']"
}
```
## Manage these concepts in the Admin Portal
Create and manage user accounts
Organize users into groups
View and create roles with permissions
Connect groups to roles and scopes
See the [Admin Portal Glossary](/user-docs/admin/glossary) for a quick reference of all terms.