Groups are a powerful tool designed to simplify how you manage access and permissions within your organization. Instead of granting permissions to users one-by-one, you can create groups, assign roles to those groups, and automatically manage access for all members at once.
Learn how to create and manage your groups here.
How groups work
The core of our user groups system is inheritance. When you grant a role (like "editor" or "viewer") to a group, every member of that group automatically inherits those permissions.
Efficiency: When a new team member joins, you simply add them to the relevant group(s), and they instantly receive all necessary access.
Offboarding: When a user leaves a team or the organization, removing them from the group automatically revokes all group-inherited permissions, ensuring your access control remains secure and up-to-date.
Note: Groups are additive. They only grant additional permissions; they cannot be used to restrict or "deny" access that a user might already have.
Key benefits and use cases
Using groups helps you maintain a clean, auditable, and scalable environment:
Team-based access: Organize users by function (e.g., "Engineering," "Product Management," "Support"). You can manage their workspace and connector access collectively rather than individually.
Role-based security: Enforce "Least Privilege" by granting permissions to groups based on the minimum access required for their function (e.g., a "Viewers" group that only has read access).
Cross-functional collaboration: Create groups for specific initiatives (e.g., "Incident Response") that pull members from different departments, granting them the specific tools they need only for the duration of the incident.
Best practices
To get the most out of your groups, we recommend the following:
Focus on roles, not individuals: Avoid creating groups for single users. Instead, think about the function or role the group performs.
Regular audits: Periodically review group memberships and associated permissions to ensure they remain relevant to your current security needs.
Use for service accounts: You can include service accounts (like CI/CD automation bots) in groups to manage their permissions just like human users.
Important constraints
Flat structure: Groups cannot be nested (you cannot put a group inside another group). We keep structures flat to ensure clarity and avoid complex permission loops.
Additive only: Groups only grant permissions. To remove access, you must remove the user from the group or adjust the group's permissions directly.
Visibility: Users can typically only see the groups they are members of or are authorized to manage.