> For the complete documentation index, see [llms.txt](https://docs.seemoredata.io/external-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.seemoredata.io/external-docs/fundamentals/settings/access-control.md).

# Access Control

Control who can sign in to Seemore, what they are allowed to change, and which of your accounts they can see.

## Overview

Access control in Seemore is built from three pieces, each answering a different question:

| Building block   | Question it answers                  | Where it lives                               |
| ---------------- | ------------------------------------ | -------------------------------------------- |
| **Users**        | Who can sign in?                     | **Settings → Access control → Users**        |
| **Roles**        | What are they allowed to change?     | The **Role** column on each user             |
| **Asset groups** | Which of your accounts can they see? | **Settings → Access control → Asset groups** |

**Teams** connect them: a team bundles people together, grants them one or more asset groups, and can carry a default [domain](/external-docs/fundamentals/settings/domains.md) view. In most organizations you set the asset groups up once, attach them to teams, and from then on manage access simply by adding people to the right team.

{% hint style="info" %}
**Required role to configure:** varies by object — **Admin** or higher for users and teams, **Owner** for asset groups. Each page below states its own requirement.
{% endhint %}

***

## How Access Is Resolved

Every request a user makes is limited to the accounts they are allowed to see. Seemore works that list out as follows:

1. **Owners see everything.** An [Owner](/external-docs/fundamentals/settings/user-roles.md) always has access to every connected account, regardless of teams or asset groups.
2. **Everyone else gets the union of their grants:**
   * accounts granted directly on their user, under **Access** in their user settings, **plus**
   * every account covered by the asset groups attached to **any team they belong to**.
3. **A single-account fallback keeps new members unblocked.** If a user ends up with no grants at all and your workspace has exactly one Snowflake account connected, they see that account. As soon as they have any grant, the fallback no longer applies.

Roles and asset access are independent, and both must allow an action: an **Editor** can change automations, but only on the accounts they can see; a **Viewer** with access to every account still cannot change anything.

The same resolution applies everywhere, not just in the UI: a personal access token or a connected AI tool sees exactly what its owner sees. See [API Access (MCP)](/external-docs/fundamentals/settings/api-access.md).

{% hint style="info" %}
Adding or removing a grant takes effect right away — the user does not need to sign out. A change to their **role**, on the other hand, applies on their next sign-in.
{% endhint %}

***

## Access Control vs. Domains

The two look similar in the UI but do very different things:

* **Asset groups control access.** What they exclude, the user genuinely cannot see anywhere in Seemore.
* [**Domains**](/external-docs/fundamentals/settings/domains.md) **control focus.** They are reusable filters a user chooses from the domain selector, applied on top of what that user can already see. Clearing the domain brings back everything they have access to.

Use asset groups when data must stay out of someone's reach, and domains when you simply want to cut down the noise.

***

## Managing Access From Your Identity Provider

If you sign in through Okta with SCIM provisioning, you can drive both roles and team membership from your identity provider instead of maintaining them by hand in Seemore. See [Identity Provider Sync](/external-docs/fundamentals/settings/access-control/identity-provider-sync.md).

***

{% content-ref url="/pages/v9X4y8beHhgXkkaAkYeE" %}
[Users](/external-docs/fundamentals/settings/access-control/users.md)
{% endcontent-ref %}

{% content-ref url="/pages/Sp1gwkUGHZn668kthWcS" %}
[Teams](/external-docs/fundamentals/settings/access-control/teams.md)
{% endcontent-ref %}

{% content-ref url="/pages/wog47bhYRmrDkj28EyLx" %}
[Asset Groups](/external-docs/fundamentals/settings/access-control/asset-groups.md)
{% endcontent-ref %}

{% content-ref url="/pages/uEq0Ck9EERrHm1ThxSoI" %}
[Identity Provider Sync](/external-docs/fundamentals/settings/access-control/identity-provider-sync.md)
{% endcontent-ref %}