> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/admin-and-configuration/security.md). # Security Trust is at the heart of what we do. ## Overview Origin Studio's Security module enables granular, role-based access control. Use it to separate catalogs, protect sensitive fields, and control actions. *** ### Where to Start **First time setting this up?** → [Concepts & Examples](https://knowledgebase.fabricdata.com/studio/~/revisions/computed_XNvUAzlHA49okKwFKxN1_4f959e6e673dc9d491fc0c33c9a530786e79932a/admin-and-configuration/security/concepts-and-examples)\ **Ready to configure?** → [Getting Started Guide](https://knowledgebase.fabricdata.com/studio/~/revisions/computed_XNvUAzlHA49okKwFKxN1_4f959e6e673dc9d491fc0c33c9a530786e79932a/admin-and-configuration/security/getting-started)\ **Already set up?** → [Managing Access](/studio/admin-and-configuration/security/managing-access.md)\ **Need to verify access?** → [Auditing & FAQ](/studio/admin-and-configuration/security/auditing-and-faq.md) *** ### The Model Tenant: your isolated Origin Studio environment. Permission Group: a logically separated library inside your tenant. Role: a named set of permissions (policies). User: a person who logs in and is assigned roles. Full mental model [here](https://app.gitbook.com/o/CiHXyCZUjsm2mW2qw4YL/s/pbuQPZAuVlwuAEzIi462/~/edit/~/changes/32/admin-and-configuration/security/concepts-and-examples#the-mental-model). ### Permission Groups A Permission Group is like a distinct catalog. It controls Record visibility end-to-end: * Records are excluded from search for unauthorized users. * Records are excluded from filters and API responses. Use it to segregate departments or business units. ### Roles and Policies A Role bundles system permissions into a reusable package. One role can contain multiple policies for flexibility. Example patterns: * TV Content Contributor: create Series/Season/Episode drafts only. * TV Content Reviewer: edit records and approve publication. ### Users and Identity Users can authenticate with email/password or SSO. See [Setting Up Single Sign-On (SSO)](/studio/admin-and-configuration/single-sign-on-sso.md). ### Section-level Access UI access can be restricted by Data Group and Section. See [Fields and Record Layout Management](/studio/admin-and-configuration/fields-and-record-layout-management.md). *** ### Video guides {% embed url="" %} {% embed url="" %}