> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM Overview

> Understand Cedar.AI Identity & Access Management (IAM): users, groups, roles, permissions, and policies.

## What is IAM?

Identity & Access Management (IAM) in Cedar.AI helps you define who (identity) has what access (role) to which resources (scope). It implements least-privilege access with flexible, policy-based controls similar to Google Cloud, Azure, and AWS.

<Card icon="shield" title="Key concepts">
  Members (users or groups) are linked to roles (collections of permissions) on resources.
</Card>

<Tip>
  **Ready to get started?** Use the [Admin Portal](/user-docs/admin/overview) to manage users, groups, roles, and bindings through a friendly interface.
</Tip>

## Identities

Users and groups define who can be granted access. See Concepts for full identity tables and example resources.

## How IAM works

High level: members get roles on resources. On access, ARMS checks whether the role includes the required permission and grants or denies. See Concepts for the full flow and diagram.

### IAM flow (example)

```mermaid theme={null}
flowchart TD
  subgraph Identities
    U[User]
    G[Group]
  end

  subgraph Authorization
    R[Role]
    PERM[Permissions]
  end

  RES[(Resource)]
  REQ[[Access request]]

  U -->|member of| G
  G -->|assigned| R
  R -->|applies to| RES
  R -->|includes| PERM

  REQ --> RES
  REQ -. check role & permissions .-> R
  R -->|grant / deny| REQ
```

### Resource examples and hierarchy

Resources can be top‑level (organization, site, operator) or sub‑resources (stations, terminals, warehouses, tracks, workflows, equipment). Roles can be assigned at any level to scope access broadly or precisely.

* Top‑level: organization, site, operator (railroad, transload, intermodal)
* Sub‑resources: station, yard/track group, warehouse, terminal, workflow, equipment/asset

```mermaid theme={null}
graph TD
  ORG[Organization / Site]
  OP["Operator (Railroad / Transload / Intermodal)"]
  ST(Station)
  YD(Yard / Track Group)
  WH(Warehouse)
  TM(Terminal)
  WF(Workflow)
  EQ((Equipment / Asset))

  ORG --> OP
  OP --> ST
  OP --> TM
  OP --> WH
  ST --> YD
  YD --> EQ
  TM --> EQ
  OP --> WF

  U(User Group)
  R1[[Role: Inventory Viewer]]
  R2[[Role: Terminal Editor]]
  R3[[Role: Warehouse Viewer]]

  U --> R1
  U --> R2
  U --> R3

  R1 -. assign to .-> OP
  R2 -. assign to .-> TM
  R3 -. assign to .-> WH

  classDef identity fill:#E0F2FE,stroke:#0284C7,stroke-width:1px,color:#0C4A6E;
  classDef role fill:#F5F3FF,stroke:#7C3AED,stroke-width:1px,color:#4C1D95;
  classDef resource fill:#ECFDF5,stroke:#059669,stroke-width:1px,color:#065F46;

  class U identity;
  class R1,R2,R3 role;
  class ORG,OP,ST,YD,WH,TM,WF,EQ resource;
```

## Resources, permissions, roles

Overview: resources are protected by permissions grouped into roles. See Concepts for definitions and examples.

## Resource hierarchy and inheritance

Summary: access granted at a top level (for example, organization, site, or operator) flows down to sub-resources (for example, terminals, groups/tracks, workflows, or individual assets). Grant at a lower level for precision. See Concepts for details.

## Roles: predefined and custom

Use predefined roles for common tasks, or define custom roles. See Policies & Roles for guidance.

## Permissions and conditions

Permissions typically map to API operations; conditions narrow access. See Concepts for examples.

## Frontend integration

High-level UX patterns: page gating, component gating, and data filtering. See Frontend Integration for guidance.

## Learn more

### Conceptual guides

<CardGroup cols={2}>
  <Card title="Why IAM" href="/user-docs/iam/problem-and-purpose" icon="circle-question">
    The problem it solves and why it matters
  </Card>

  <Card title="Concepts" href="/user-docs/iam/concepts" icon="list-tree">
    Identities, resources, permissions, roles, conditions
  </Card>

  <Card title="Policies & Roles" href="/user-docs/iam/policies-and-roles" icon="scroll">
    Define who can do what on which resource
  </Card>

  <Card title="Feature Sets" href="/user-docs/iam/feature-sets" icon="grid-2">
    Grant a whole product feature in one matrix click; Cedar keeps it current
  </Card>

  <Card title="Customer Portal" href="/user-docs/iam/customer-portal" icon="users">
    Configure customer-facing access with IAM
  </Card>
</CardGroup>

### Admin Portal (practical guides)

<CardGroup cols={2}>
  <Card title="Admin Portal Overview" href="/user-docs/admin/overview" icon="gauge-high">
    Get started with the Admin Portal interface
  </Card>

  <Card title="Users" href="/user-docs/admin/users" icon="user">
    Manage individual user accounts
  </Card>

  <Card title="User Groups" href="/user-docs/admin/user-groups" icon="users">
    Organize users into teams
  </Card>

  <Card title="Roles" href="/user-docs/admin/roles" icon="key">
    View and create permission sets
  </Card>

  <Card title="Bindings" href="/user-docs/admin/bindings" icon="link">
    Grant access by connecting groups to roles
  </Card>

  <Card title="Glossary" href="/user-docs/admin/glossary" icon="book">
    Quick reference for all IAM terms
  </Card>
</CardGroup>