Groups

Put people in groups, give groups access with policies, and let groups approve risky calls.

A group is a named set of people, like Platform, Contractors or Payments on-call. Groups do two jobs:

• Policies target groups. A policy can apply to any mix of groups and individual people.
• Groups approve calls. A "Require approval" policy can name a group whose members approve each call.

Find them under Groups.

#Where groups come from

Groups from a directory or SCIM are read-only in Gatehouse, so the source stays the single place to manage them.

#Create a group

1. Go to Groups → New group.
2. Give it a name and, optionally, a description.
3. Pick its members and click Create group.

You can also add someone to groups from People → Manage, or when you invite them.

#Give a group access

Open the group and click New policy for this group. The policy editor opens with the group already selected. Under For whom, choose Groups and people to combine groups with individual people. Someone matches if they are in any listed group or are listed by name.

Some common patterns:

• Allow a group, deny one person. An allow rule for Platform, plus a deny rule for one email on *__delete_*. Deny wins.
• Group plus guests. Allow Data and two auditors by email to query the analytics replica.
• Approvals by a group. A "Require approval" rule for production deploys, approved by SRE. Nobody approves their own call.

The group's page lists every policy that applies to it and every policy it approves for.

#Rename and delete

Renaming a local group updates every policy, pending approval, invite and SSO default that names it, in one step.

A group that a policy uses can't be deleted. Change those policies first, so a rule never silently stops matching anyone.

#How quickly changes apply

Membership is checked on every tool call. Adding someone to a group gives their agents access on the next call. Removing them takes access away on the next call. Tool lists in agents refresh automatically.