---
title: "TIR Access Control"
description: "Decide who can use your TIR account and projects, and what each person can do, with the IAM page, roles, policies, and Audit Logs."
content_type: "overview"
product: "tir-iam"
platform: "TIR"
url: "/tir/tir-iam/"
---

# TIR Access Control

Access control in TIR decides who can use your account and what each person can do in it. You invite
people from the **Identity & Access Management (IAM)** page, give each one a role, and place them in the projects where they work. A
project is the workspace that holds your instances, datasets, endpoints, and other resources, so the
project a person belongs to is the work they can reach.

TIR has five roles:

| Role                | Use it for                                                                                            |
| ------------------- | ----------------------------------------------------------------------------------------------------- |
| **Owner**           | The account's owner, with access to every project and every user.                                     |
| **Admin**           | Someone who runs the account with you: every project, and every user except Admins and the Owner.     |
| **Project Manager** | Someone who runs the projects given to them, can create new ones, and adds Project Leads and Members. |
| **Project Lead**    | Someone who runs the day-to-day work of a project and adds Members to it.                             |
| **Member**          | Someone who uses some of a project's services, chosen by a policy.                                    |

A policy lists the services a Member can use in a project, and for each service whether they can read,
create, update, or delete. Every Member has at least one policy, so you decide exactly which parts of a
project they work with.

## Where to find it

- **Identity & Access Management (IAM)** in the account menu at the top right, the button that shows your
  name and email, lists everyone in the account and every invitation you have sent.
- **Project Settings** in the project side menu holds one project's members, on **Project Members**, and its
  policies, on **Policies**.
- **Audit Logs** in the same account menu lists what happened in the account.

## What you can do

### Bring people in

- [Manage users in IAM](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/): invite people, send
  an invitation again, change a person's role and projects, and remove them.
- [Manage project members and policies](/tir/tir-iam/how-to/manage-project-members-and-policies/): add
  people to one project, and create the policies that decide what a Member can use.

### Review and understand access

- [View Audit Logs](/tir/tir-iam/how-to/view-audit-logs/) to see who did what, and export it.
- [Roles and permissions](/tir/tir-iam/concepts/roles-and-permissions/) compares what each role can do.
- [Access without teams](/tir/tir-iam/concepts/access-without-teams/) explains how projects and roles
  from the former team layout carried over.

## Where to start

[Get started with TIR Access Control](/tir/tir-iam/get-started/) invites a teammate into a project. For
help with an invitation or a permission message, see
[Troubleshooting TIR Access Control](/tir/tir-iam/troubleshooting/tir-iam/), and the
[TIR Access Control FAQ](/tir/tir-iam/faq/) has short answers.