Docs / Contact / iam/overview

Access Control Overview

Contact uses a policy-based IAM model. Every principal (a user, an entity, or an API key) is assigned a role, and each role groups one or more policies that describe what actions are allowed on which resources. New entities and entity-bound keys default to the DefaultEntity role.

Model

User, entity, or API key
   └── Role (one per principal)
        └── Policies (one or more attached)
              └── Statements (Effect, Action, Resource, optional Condition)

• Users: people who sign into the dashboard
• API keys: non-interactive credentials (entity keys or account keys; see API Keys)
• Roles: named bundles of permissions. Four built-in roles (Admin, ReadOnly, FleetOperator, DefaultEntity) plus any you create
• Policies: IAM-style statements that grant or deny specific actions. A policy may inherit from another, and may be scoped to a directory so it covers a whole subtree of devices

Where to manage it

Everything lives under Access Control in the Contact sidebar:

Read on

• Users: invite members and assign roles
• Roles: built-in roles, the default entity role, and assigning roles to users, entities, and API keys
• Policies: statement format, conditions, inheritance, directory scoping, and the full action reference

← Back to Contact docs