> For the complete documentation index, see [llms.txt](https://docs.globalalerting.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.globalalerting.com/administration/access-control/access-control-concepts.md).

# Access Control Concepts

GAP is a multi-tenant platform.

Data is stored in a central repository, separated by logical identifiers using the concept of tenants.

## Tenants

A tenant is a container for GAP data - this includes users, devices, geofences, rules and event other tenants.

Tenants act as security boundaries and are organised into a hierarchy.  Think of it as trees in a forest, with branches and leaves but no shared roots.

The root tenant in each hierarchy is called the top-level tenant.  Child tenants are called sub-tenants.

{% hint style="warning" icon="triangle-exclamation" %}
Once created, tenants cannot be moved to other places in the tenant hierarchy.  We recommend designing your tenant structure prior to implementation and keeping it as simple as possible.
{% endhint %}

See [Managing Tenants](/administration/access-control/managing-tenants.md) for more information.

## Users

A user represents a person with some level of access to GAP.

A user account resides in a tenant.  By default, users in a sub-tenant cannot view objects in a parent tenant (unless that object has been specifically shared with them).

A user also cannot see data in tenants at the same level in the tenant hierarchy as their own.

See [Managing Users](/administration/access-control/managing-users.md) for more information.

## User Roles

The role assigned to a user account determines the functionality that user can access.  It also is a factor in determining the objects (e.g. devices, users, etc.) that the user can access.

There are two built-in roles:

* User - has limited permissions (e.g. can view only devices assigned to them).
* Administrator - has the ability to view and manage all objects in their tenant and any sub-tenants.

See [Managing User Roles](/administration/access-control/managing-user-roles.md) and [User Roles Reference](/administration/access-control/user-roles-reference.md) for more information.

## Collections

More complex access control requirements can be met through the use of collections.

A collection comprises devices, groups of devices and / or tenants.  These collections are assigned to users, who are in turn granted access to them.

See [Managing Collections](/administration/access-control/managing-collections.md) for more information.