Admission and access - IDYL Docs

IDYL uses account access and subnet admission for different decisions. Account access controls what an identity can do in an account. Subnet admission controls who can deploy to a subnet and which provider capacity can join it.

Account access

Account access answers: who can perform actions in this account? IAM concepts include:

Concept	Use
Member	A user with access to an account.
Group	A collection of users for permission management.
Service account	A machine identity for automation.
Policy	Permission statements that allow or deny actions on resources.
Access profile	A reusable permission template composed from policies.
Assignment	A binding between an identity, an access profile, and a target account.
Personal access token	A user token for API authentication.
Service account token	A service account token for automation.

Membership alone does not grant permissions. Permissions come from assignments to access profiles.

Subnet admission

Subnet admission answers: who can use this subnet? Developer admission controls which accounts may submit workloads. Provider admission controls which fleets or nodes may join as capacity. Admission modes are:

Mode	Meaning
`open`	Participation is allowed without a grant for that admission type.
`approval`	Participation requires an admission grant.
`invite`	Participation is invite-based for that admission type.

How they work together

A successful operation can require both layers. For example, deploying a workload requires account permissions to create the workload and subnet permission to use the target subnet.