> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idyl.network/llms.txt
> Use this file to discover all available pages before exploring further.

# Admission and access

> How account permissions and subnet admission work together.

IDYL uses account access and subnet admission for different decisions.

Account access controls what an identity can do in an account. Subnet admission controls who can deploy to a subnet and which provider capacity can join it.

## Account access

Account access answers: who can perform actions in this account?

IAM concepts include:

| Concept               | Use                                                                     |
| --------------------- | ----------------------------------------------------------------------- |
| Member                | A user with access to an account.                                       |
| Group                 | A collection of users for permission management.                        |
| Service account       | A machine identity for automation.                                      |
| Policy                | Permission statements that allow or deny actions on resources.          |
| Access profile        | A reusable permission template composed from policies.                  |
| Assignment            | A binding between an identity, an access profile, and a target account. |
| Personal access token | A user token for API authentication.                                    |
| Service account token | A service account token for automation.                                 |

Membership alone does not grant permissions. Permissions come from assignments to access profiles.

## Subnet admission

Subnet admission answers: who can use this subnet?

Developer admission controls which accounts may submit workloads. Provider admission controls which fleets or nodes may join as capacity.

Admission modes are:

| Mode       | Meaning                                                           |
| ---------- | ----------------------------------------------------------------- |
| `open`     | Participation is allowed without a grant for that admission type. |
| `approval` | Participation requires an admission grant.                        |
| `invite`   | Participation is invite-based for that admission type.            |

## How they work together

A successful operation can require both layers.

For example, deploying a workload requires account permissions to create the workload and subnet permission to use the target subnet.

## Related guides

* [Control admission](/operate/control-admission)
* [Approve deploy access](/operate/approve-deploy-access)
* [Manage fleets](/provide/manage-fleets)