A group is a named set of users. Groups do three jobs:

• Policy subjects. A policy can grant access to a group instead of listing people one by one.
• Approvers. A policy can name a group whose members approve requests.
• Customer scope. A group can carry a list of customers its members may see.

A group does not hold permissions. What someone may do in Shellius comes from their role — see Team and roles. A group decides which servers a policy applies to them for, and which customers they can see.

Required permissions

Permission	Lets you
groups.view	See groups and their members.
groups.manage	Create, edit and delete groups, and add or remove members.
users.assign_scope	Change a group's customer scope.

Create a group

1. Open Administration › Groups and select Create Group.
2. Enter a Name and, optionally, a Description. Names are unique within the organisation.
3. Save, then open the group.

Add and remove members

1. Open the group and select Add member.
2. Search for the user and add them.

To remove someone, use Remove member on their row. Both actions are audited, as group.member.added and group.member.removed. Removing someone from a group does not delete the user.

Membership takes effect on the person's next request. They do not need to sign in again.

Customer scope

By default every user sees the whole organisation. A user's access scope can instead be set to Selected customers, in which case they see only those customers and the servers under them. Everything else behaves as though it does not exist: lists omit it, and a direct link returns "not found" rather than "forbidden".

A group's Customer scope section adds to that. It has two settings:

Setting	Effect on members
Selected customers	Members whose own scope is Selected customers also see the customers listed here. Their visible set is their own customers plus those of every group they are in. An empty list adds nothing.
Entire organization	Every member becomes unrestricted for as long as they are in the group, including members whose own scope is Selected customers.

A new group starts as Selected customers with nothing selected, so it has no effect on visibility until you change it.

Entire organization removes restrictions

Adding a restricted user to a group set to Entire organization is the same as clearing their personal restriction. Removing them from the group restores it. Use it deliberately.

A few rules hold throughout:

• Super admins are never scoped.
• Scope only narrows. A scoped user still needs an allow policy to connect to anything. Seeing a server is not access to it.
• Nobody can widen their own scope, and you can only grant customers that are within your own.
• Alerts respect it. A scoped user is never notified about a customer they cannot see.

Delete a group

Open the group and select Delete. The dialog lists what will happen: how many members are removed from the group, and which policies the group is removed from.

WARNING

If the group was a policy's only subject, that policy is left with no subjects and grants access to nobody until you add one. The dialog names the affected policies so you can fix them afterwards.

Deleting a group cannot be undone.

Next steps

Access policiesUse a group as a policy subject or as its approvers.Team and rolesRoles and permissions decide what people can do.CustomersThe unit that customer scope is built on.