# IAM

IAM controls who can act on a Project's resources and which operations they can perform. It combines service-defined permissions, roles, policies, and identities for software.

## Why use IAM?

Different people and applications need different access to the same Project. IAM lets you assign the permissions needed for a task and inspect those assignments as the application grows.

## What you can do

- Discover permissions and predefined roles published by services.
- Create Project-owned custom roles from service permissions.
- Read and update Project policies and inherited Account policies.
- Manage service accounts and their credentials for software acting on Project resources.

## Core concepts

A **Permission** names an allowed operation. A **Role** groups permissions. A **Policy** binds roles to members and can include conditions and deny rules. A **Service account** gives software an identity that can be assigned access.

OAuth handles client registration and token issuance. IAM handles access policies for Project resources. Enabling a service through Service Usage is a separate step from granting an identity permission to use it.

## Use IAM

Read the [CLI reference](/docs/iam/reference/cli) for commands or the [API reference](/docs/iam/reference/api) for resources, request fields, and responses.

## Related services

- [Projects](/docs/project)
- [Service Usage](/docs/service)
- [OAuth](/docs/oauth)

---

Company: Socra — Multiply Your Judgment
Canonical URL: https://cloud.socra.com/docs/iam