> For the complete documentation index, see [llms.txt](https://docs.cloud.olakrutrim.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud.olakrutrim.com/basics/identity-access-management/users.md).

# Users

Users represent **human identities** that can access Krutrim Cloud resources.\
All access granted to a user is evaluated through **roles and groups**.

{% hint style="info" %}
Users never receive permissions directly. Permissions are always inherited via roles
{% endhint %}

***

### User Types

#### Root User

* Created during account sign-up
* Owner of the account
* Can manage all IAM entities
* Cannot be modified or deleted by other users

#### IAM User

* Invited by the root user or an authorized admin
* Has scoped permissions
* Can have console access, programmatic access, or both

{% hint style="warning" %}
One email address can be associated with **only one root user**, but may be used for multiple IAM users across different organizations.
{% endhint %}

***

### Adding a User

Adding a user is a **two-step flow**:

1. Enter user details
2. Assign roles and/or groups

Only the **root user** or users with appropriate IAM permissions can add new users.

***

#### Step 1: Enter User Details

Navigate to **IAM → Users** and click **Add User**.

Fill in the following fields:

1. **Email**
   1. Email address of the user being invited
   2. Used as the login identifier
2. **Username**
   1. Unique username within the organization
   2. Used for display and identification
3. **Generated Password**
   1. System-generated temporary password
   2. Cannot be manually edited
   3. Can be:
      1. Regenerated using the refresh icon
      2. Copied using the copy icon

Click **Next** to continue.

***

#### Step 2: Assign Roles and Groups

In this step, you assign **how the user gets permissions**.

1. **Assign Roles**
   1. Select one or more roles to attach directly to the user
   2. Search is available to quickly find roles
2. Each role shows:
   1. Role name
   2. Short description
3. **Assign Groups**
   1. Switch to the **Groups** tab
   2. Select one or more groups
   3. The user will inherit all roles attached to those groups

{% hint style="info" %}
At least one role or group must be assigned
{% endhint %}

Click **Send Invitation** to complete the process.

***

### What Happens After Invitation

* The user receives an email with:
  * Organization ID
  * Login email
  * Preset password
* We recommend that the user reset their password after logging in for the 1st time.
* Permissions are enforced immediately after login.