> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity & access

> How Cobalt knows who is asking and who can administer your workspace.

# Identity & access

Cobalt has two distinct kinds of identity. Keep them separate in your head — they
are configured in different places and serve different purposes.

|             | **Administrators**                                                                           | **End users**                                                                |
| ----------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| Who         | People who run the console — configure agents, integrations, team                            | People who talk to your agents in a channel                                  |
| Sign in via | Your console sign-in (email/password, social, or **enterprise SSO**)                         | Whatever the channel provides — a web sign-in, a Slack ID, an email          |
| Scoped to   | Your [tenant](/reference/glossary#tenant); cross-tenant access is rejected at the data layer | Your tenant; resolved to a canonical person via **identity resolution**      |
| Governed by | **Roles** (and optionally your IdP groups)                                                   | **Identity rules**, **verification**, and per-connection authorization tiers |

Everything an administrator does is tenant-scoped. End users never sign in to the
console — they are identified by the channel they arrive through, and Cobalt maps
that inbound identity to a known person.

## Administrator topics

<CardGroup cols={2}>
  <Card title="Admin sign-in" href="/identity/admin-sign-in">
    Email/password, social login, sessions, and account recovery.
  </Card>

  <Card title="Roles & team" href="/identity/roles-and-team">
    What each role can do, and how to invite and manage your team.
  </Card>

  <Card title="Enterprise SSO" href="/identity/sso">
    Connect SAML so your team signs in with corporate credentials — and map IdP
    groups to Cobalt roles.
  </Card>

  <Card title="SCIM provisioning" href="/identity/scim">
    Auto-provision and de-provision users from your identity provider.
  </Card>
</CardGroup>

## End-user topics

<CardGroup cols={2}>
  <Card title="End-user identity" href="/identity/end-user-identity">
    Canonical users, channel identities, resolution rules, the review queue, and
    trust tiers.
  </Card>

  <Card title="Web widget authentication" href="/channels/web-widget">
    Identify users on an embedded widget without a second sign-in.
  </Card>
</CardGroup>

For where identity fits in the bigger picture, see
[How Cobalt works](/concepts/how-cobalt-works#identity-connects-a-request-to-a-person).