# Identity & Access Management

IAM controls what users and service accounts can do in Lenses. Permissions flow from **principals → groups → roles → policies**. If any policy statement matches with `effect: deny`, access is denied.

### Common setup flow

{% stepper %}
{% step %}

### Configure authentication

Pick Basic Auth or SSO/SAML.
{% endstep %}

{% step %}

### Create roles and policies

Define actions, resources, and `allow`/`deny`.
{% endstep %}

{% step %}

### Create groups and assign roles

Attach one or more roles to each group.
{% endstep %}

{% step %}

### Add users and service accounts to groups

Membership drives permissions.
{% endstep %}

{% step %}

### Validate access

Log in as a user and check expected visibility and actions.
{% endstep %}
{% endstepper %}

<table data-view="cards"><thead><tr><th>Topic</th><th>Description</th><th data-hidden data-card-target data-type="content-ref">Link</th></tr></thead><tbody><tr><td><strong>Overview</strong></td><td>Core concepts and policy evaluation</td><td><a href="iam/overview">overview</a></td></tr><tr><td><strong>Authentication</strong></td><td>Basic Auth, SSO/SAML, and admin accounts</td><td><a href="../deployment/configuration/authentication">authentication</a></td></tr><tr><td><strong>Users</strong></td><td>Create users and manage group membership</td><td><a href="iam/users">users</a></td></tr><tr><td><strong>Service Accounts</strong></td><td>Programmatic access via service account tokens</td><td><a href="iam/service-accounts">service-accounts</a></td></tr><tr><td><strong>Groups</strong></td><td>Collect principals and grant roles</td><td><a href="iam/groups">groups</a></td></tr><tr><td><strong>Roles</strong></td><td>Create roles and attach policies</td><td><a href="iam/roles">roles</a></td></tr><tr><td><strong>IAM Reference</strong></td><td>All actions and resource formats</td><td><a href="iam/iam-reference">iam-reference</a></td></tr><tr><td><strong>Example Policies</strong></td><td>Ready-to-use role templates</td><td><a href="iam/example-policies">example-policies</a></td></tr></tbody></table>