> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Access

> Practical guide for creating custom roles and managing your security team.

import { Steps, Step, CardGroup, Card, Warning, Note } from "@mintlify/components";

Managing access in Myrmex involves creating the right roles and assigning them to the right people. This guide covers how to tailor the RBAC system to your specific organizational needs. For adding environmental restrictions (time, IP, MFA), see [Security Policies](/pt/documentation/management/security-policies/overview).

## Creating Custom Roles

Custom roles allow you to create specialized access patterns for unique teams like "Cloud Security" or "Regional Auditors."

<Steps>
  <Step title="Access Role Management">
    Navigate to **Organization Settings → Roles** and click **"New Role"**.
  </Step>

  <Step title="Define Information">
    Provide a name and description. You can also provide translations for multi-lingual teams.
  </Step>

  <Step title="Select Permissions">
    Browse through the Core, Devices, Chat, and Billing modules to select the specific capabilities needed for this role.
  </Step>

  <Step title="Assign Asset Group">
    Select an existing Asset Group or create a new one to define the scope of the role's authority.
  </Step>
</Steps>

***

## Inviting and Managing Users

<CardGroup cols={2}>
  <Card title="Invite Users" icon="user-plus">
    Go to **Organization Settings → Team** and click **"Invite User"**. Provide their email and assign one or more roles.
  </Card>

  <Card title="Effective Permissions" icon="plus">
    Users receive the **union** of all permissions from all assigned roles. This allows for modular role assignment.
  </Card>
</CardGroup>

### Managing Service Users

Service users are special accounts designed for API integrations and automation.

* **No Interactive Login:** Access is via API tokens only.
* **Limited Scope:** Can be assigned specific roles and Asset Groups just like human users.
* **Use Case:** Connecting a SIEM or custom automation scripts to the Myrmex API.

***

## Best Practices

<CardGroup cols={1}>
  <Card title="Principle of Least Privilege" icon="shield-halved">
    Always grant the minimum permissions necessary. Start with restrictive roles and add permissions only as needed.
  </Card>

  <Card title="Use Descriptive Names" icon="tag">
    Name roles by their scope and function, e.g., "LATAM Analyst" rather than "Team A".
  </Card>

  <Card title="Regular Audits" icon="clock-rotate-left">
    Periodically review user roles and Asset Group scopes to ensure they align with current job functions and regional boundaries.
  </Card>
</CardGroup>

<Warning>
  Removing all roles from a user will deny them access to the platform immediately. Always ensure active users have at least one role assigned.
</Warning>

***

## Adding Conditional Access

Once roles are configured, you can add environmental restrictions using [Security Policies](/pt/documentation/management/security-policies/overview):

<CardGroup cols={2}>
  <Card title="Security Policies" icon="shield-halved" href="/pt/documentation/management/security-policies/overview">
    Add time-based, network-based, and MFA-based restrictions on top of RBAC roles.
  </Card>

  <Card title="Policy Conditions" icon="sliders" href="/pt/documentation/management/security-policies/conditions">
    Explore all available condition types: IP, time, day, MFA, device type, user agent.
  </Card>
</CardGroup>