# What is Origin Cloud IAM?

IAM controls who can do what in your Origin Cloud organization. Learn how principals, roles, role assignments and permissions fit together.

IAM (Identity and Access Management) controls who can do what in your organization. You give people and automation access by assigning them built-in roles, either across the whole organization or for one project. Every API request is checked against those assignments, so you can also ask in advance whether a request will be allowed.

A principal is a user or a service account. A role assignment gives a principal one role, either org-wide or for a single project. The role is a fixed set of permissions, and each permission allows one action, such as `compute.instance.launch`, on resources inside the assignment's scope. For the details, see [Access model](/docs/iam/access-model).

## Features [#features]

- **Built-in roles**: Owner, Viewer, IAM Editor and three billing roles, each with a fixed set of permissions. See [Built-in roles](/docs/iam/roles).
- **Role assignments**: Grant a role to a user or service account org-wide or for one project, and revoke it again. See [Assign and revoke roles](/docs/iam/assign-roles).
- **Organization members**: Invite people by email, list who has access, and remove a member's access in one step. See [Manage organization members](/docs/iam/manage-members).
- **Service accounts**: Non-interactive credentials for CI pipelines, scripts and infrastructure-as-code tools, with their own principal and roles. See [Service accounts](/docs/iam/service-accounts).
- **Access checks**: Look up your own grants, list available permissions, and check whether a principal holds a permission on a resource. See [Check access](/docs/iam/check-access).
- **Audit log**: A record of who changed access in your organization and when. See [Audit log](/docs/iam/audit-log).

## Ways to access IAM [#ways-to-access-iam]

- **CLI**: The `origin iam` command group. See [CLI access](/docs/platform/access/cli) to install and sign in, and [origin iam commands](/docs/iam/reference/cli) for every command.
- **GraphQL API**: IAM queries and mutations live under the `iam` namespace of the API. See [API access](/docs/platform/access/api) and the [IAM reference](/docs/iam/reference) for the list of operations.

## Limitations [#limitations]

- Custom roles aren't supported. You can assign and revoke the built-in roles only.
- Groups aren't principals. The API lists three built-in groups by name and description, but you can't add members to a group or assign a role to one.
- Role assignments are unconditional. You can't restrict a grant to a time window or an extra attribute check.
- A service account's access is the union of its roles. You can't narrow one credential to a subset of what its roles allow.
- Service accounts authenticate against the platform's own identity provider only. Federation with an external identity provider isn't supported.

For quotas, see [Limits](/docs/platform/reference/limits).

## Related [#related]

- [Organizations and projects](/docs/platform/organizations): the scopes that role assignments apply to
- [Billing access](/docs/platform/billing/billing-access): who can see and change billing accounts
- [CLI access](/docs/platform/access/cli): log in with `origin id login`

## Next steps [#next-steps]

- Read the [Access model](/docs/iam/access-model) to understand scopes and permissions.
- [Invite a member](/docs/iam/manage-members) to your organization.
- [Create a service account](/docs/iam/service-accounts) for automation.