---
title: Groups | Keycard
description: Overview of Groups within the Keycard platform.
---

A Group is a named collection of [Users](/concepts/users/index.md) within a [Zone](/concepts/zones/index.md). Groups let you grant access to a set of Users at once: assign a Role to a Group and every member inherits it, or name the Group in a policy instead of enumerating each User.

Groups are created and managed by an Admin. See [Groups](/admin/groups/index.md) for the Console steps.

Coming soon

Provisioning Users and Groups from your identity provider over SCIM 2.0 is coming soon.

## Name and Identifier

Every Group has a display name and an identifier that is unique within the Zone. The identifier is what policy rules match on, so it is the stable reference for a Group. Both can be changed at any time.

## Membership

A User can belong to any number of Groups. Groups cannot be nested: only Users can belong to Groups.

## Roles

A Group can be assigned organization Roles and custom Zone Roles. Every member of the Group inherits them, and a User’s effective Roles are the union of the Roles assigned to them directly and the Roles assigned to every Group they belong to. Removing a User from a Group removes the Roles they were assigned through it.

## Groups in Policy

Group membership is a first-class entity in [policy](/concepts/policies/index.md) evaluation. A Cedar rule matches a Group with the `in` operator:

```
permit (
  principal in Keycard::Group::"data-analysts",
  action,
  resource
);
```

Membership is resolved at evaluation time

Group membership is read when the request is evaluated, not from a claim on the credential the caller presented, so adding or removing a member changes access without a policy update and without the User signing in again. This is distinct from the raw `groups` claim your identity provider may put on an ID token, which policies can still read as `context.subject_claims.groups`.

See [Group-based policies](/admin/access-policies/#group-based-policies/index.md) for the full policy reference and more examples.