> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Asset Groups: Controlling Scope

> Segment resource access across organizational boundaries and security contexts.

import { CardGroup, Card, Steps, Step, Note, AccordionGroup, Accordion } from "@mintlify/components";

While **permissions** define *what* a user can do, **Asset Groups** define *where* they can do it. This is a critical security feature that allows you to segment access across organizational boundaries and security contexts.

### What Are Asset Groups?

An Asset Group is a scope definition that determines which assets (devices, integrations, sites, accounts) a role can access. Every role must be associated with an Asset Group.

<CardGroup cols={2}>
  <Card title="Without Asset Groups" icon="ban" color="#ef4444">
    **Broad Access.** A user with `devices.read` could see ALL devices in the entire organization, regardless of context or sub-organization.
  </Card>

  <Card title="With Asset Groups" icon="shield-check" color="#10b981">
    **Scoped Access.** A user with `devices.read` + "LATAM Asset Group" can only see devices in Latin American contexts.
  </Card>
</CardGroup>

***

## Asset Group Components

Asset Groups define three levels of scope:

<Steps>
  <Step title="Organization Scope">
    Determines which organizations the role can access:

    * **Current Organization Only:** Access only the user's primary organization.
    * **Current + All Sub-Organizations:** Access parent and all child organizations (Enterprise).
    * **Specific Organizations:** Access only explicitly listed entities.
  </Step>

  <Step title="Context Scope">
    Determines which security contexts within those organizations are accessible:

    * **All Contexts:** Unrestricted access to all environments.
    * **Specific Contexts:** Access only explicitly listed contexts (e.g., "production", "LATAM", "tier-1").
  </Step>

  <Step title="Asset Rules">
    For fine-grained control, specify exactly which assets are accessible:

    * **All Assets:** Access all devices/integrations/sites in the context.
    * **Specific Assets:** Access only listed asset IDs (e.g., only firewalls, only specific integrations).
  </Step>
</Steps>

***

## Common Asset Group Patterns

<AccordionGroup>
  <Accordion title="Full Organization Access (Super Admin Pattern)">
    **Org Scope:** Current + All Subs | **Context Scope:** All | **Asset Rules:** All\
    Used for platform administrators who need unrestricted access.
  </Accordion>

  <Accordion title="Regional/Context-Limited Access">
    **Org Scope:** Current Only | **Context Scope:** Specific (e.g., "EMEA") | **Asset Rules:** All\
    Used for teams responsible for specific geographic regions or environments.
  </Accordion>

  <Accordion title="Specialized Asset Access">
    **Org Scope:** Current Only | **Context Scope:** All | **Asset Rules:** Specific Types (e.g., "Firewalls")\
    Used for specialized teams that work only with specific security tools.
  </Accordion>
</AccordionGroup>

***

## Creating Asset Groups

<Steps>
  <Step title="Navigate to Asset Groups">
    Go to **Organization Settings → Asset Groups**.
  </Step>

  <Step title="Define Scope">
    Select your Organization and Context levels as described above.
  </Step>

  <Step title="Define Rules (Optional)">
    Add specific asset-level restrictions if you need to limit access to individual devices or integration types.
  </Step>

  <Step title="Associate with Roles">
    When creating or editing a role, select the Asset Group to apply these scoping rules.
  </Step>
</Steps>

<Note>
  Roles without an Asset Group have unrestricted access to all assets. Always assign an appropriate Asset Group to maintain the principle of least privilege.
</Note>