> ## Documentation Index
> Fetch the complete documentation index at: https://hexelstudio.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM & Organizations

> Manage identities, access control, and environment isolation.

IAM controls who can access Hexel Studio, what they can do, and how resources are isolated across your organization. Members, roles, environments, and credentials are all governed here — set it up correctly once and it protects everything downstream.

## Why IAM matters for multi-team setups

| Concern                 | How IAM addresses it                                                                                                                                 |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Blast radius**        | Credentials scope to a single workspace + environment. A compromised staging key cannot touch production resources.                                  |
| **Billing attribution** | Usage records roll up per environment, so you can attribute cost to the team or project that incurred it.                                            |
| **Compliance**          | RBAC permissions follow the `data-platform:<resource>:<action>` / `orchestrator:task:write` pattern, giving auditors a clear map of who can do what. |

## In this section

<CardGroup cols={2}>
  <Card title="Environments" icon="layer-group" href="/docs/iam/environments">
    Isolated contexts for production, staging, and development.
  </Card>

  <Card title="Members & Roles" icon="users" href="/docs/iam/members-and-roles">
    People in your organization and what they can do.
  </Card>

  <Card title="API Keys" icon="key" href="/docs/iam/api-keys">
    Credentials for development and scripts.
  </Card>

  <Card title="Service Accounts" icon="robot" href="/docs/iam/service-accounts">
    OAuth clients for production services.
  </Card>
</CardGroup>

## Resource hierarchy

Resources are scoped across three levels:

```
Organization → Workspace → Environment
```

* **Organization** — members, billing, and roles.
* **Workspace** — a project or team grouping.
* **Environment** — an isolated context where resources live (production, staging, development).

See [Organizations](/docs/concepts/organizations) for the full model.

## How you manage it

Members, roles, service users, API keys, and OAuth clients are managed in the Console under **IAM**. Credentials are scoped to a workspace and environment, and every API request is authorized against the identity behind the token.

## Next steps

Start with [Environments](/docs/iam/environments), or jump to [API Keys](/docs/iam/api-keys) to create your first credential.