---
title: "Create a policy set"
description: "Build a MyAccount policy set scoped to one project or to a user group, tick the services it covers, and attach it to a user or a group."
content_type: "how-to"
product: "account"
platform: "MyAccount"
url: "/myaccount/account/how-to/create-a-policy-set/"
topic: ["users-and-access"]
---

# Create a policy set

A policy set says, service by service, what a **Member** or **Billing + Member** user can see and
do. You build it once and give it to as many users or user groups as need it.

## Before you begin

You need to be an **Admin** or a **Project Lead**: these two roles manage policy sets in IAM.

A Project Policy belongs to the project you are working in when you click **Add Project Policy**, so
switch to that project first. If it does not exist yet, see
[Create a project](/myaccount/account/how-to/create-a-project/). A User Group Policy belongs to no
project.

## Project Policy Set or User Group Policy Set

**Policy Set** has two kinds:

- A **Project Policy Set** is scoped to one project.
- A **User Group Policy Set** is scoped to an account-wide user group.

Each list shows the policy set's name and its description.

## Create a policy set

1. Open **Identity & Access Management (IAM)** from the account menu, then **Policy Set**.
2. Click **Add Project Policy** or **Add User Group Policy**, depending on the scope you want.
3. In **Policy Set Name**, enter a name of up to 50 characters. In **Description**, enter up to 100
   characters. Both are required, and neither can be only spaces. The name must differ from every
   other policy set in the project and from E2E's built-in policies. MyAccount refuses a name
   already taken with **Policy Name Should be Unique.**
4. For each service listed, tick any of **Read**, **Create**, **Update**, and **Delete**.
5. Click **Save**.

A few services keep only **Read**, whatever you tick: choosing **Create**, **Update**, or
**Delete** on one of them clears that service's row instead, leaving only **Read** checked.

## Attach the policy

To give a policy to a user, pick it for one of their projects on **Add User** or **Edit**. To give
one to a **User Group**, pick a **User Group Policy** when you create the group, or afterwards. See
[User groups](/myaccount/account/how-to/user-groups/) and
[Choose a role for a user](/myaccount/account/how-to/choose-a-role-for-a-user/).

On a policy's row, the action menu offers **View**, **Clone**, **Edit**, and **Delete**. A built-in
policy offers only **View** and **Clone**. To start from one, clone it and edit the copy.

To delete a policy set, first take it off everyone it was given to. While anyone in a project
still has it, MyAccount refuses **Delete** with
**This policy is part of access for multiple Project Members, so you cannot delete it.**

Once you attach your policy set to a user or a user group, they see only what the policy allows. A
project with a policy can now be picked for a **Member** on **Add User**; see
[Invite a user](/myaccount/account/how-to/invite-a-user/).