---
title: "Access control"
---
Who can do what in a workspace that's already running: the roles and permissions you grant, the attributes you record about people, and the policies that decide which teams and channels they can reach.

- [Manage team and channel members](/administration-guide/manage/team-channel-members) - Add, remove, and change the roles of members.
- [Advanced permissions](/administration-guide/onboard/advanced-permissions) - Customize what each role is allowed to do.
  - [Advanced permissions: backend infrastructure](/administration-guide/onboard/advanced-permissions-backend-infrastructure) - How the permissions system is structured.
- [Delegated granular administration](/administration-guide/onboard/delegated-granular-administration) - Grant admin access to part of the System Console.
- [Attribute-based access control](/administration-guide/manage/admin/attribute-based-access-control) - Grant access based on user attributes rather than membership lists.
  - [User attributes](/administration-guide/manage/admin/user-attributes) - Define the custom attributes that access rules are written against.
  - [System-wide attribute-based access policies](/administration-guide/manage/admin/abac-system-wide-policies) - Organization-wide policies System Admins assign to teams and channels.
  - [Team membership policies](/administration-guide/manage/admin/abac-team-membership) - Control who can join a team.
  - [Team channel policies](/administration-guide/manage/admin/abac-team-channel-policies) - Channel membership policies Team Admins manage from Team Settings.
  - [Channel-specific access rules](/administration-guide/manage/admin/abac-channel-access-rules) - Access rules Channel Admins manage from Channel Settings.

Setting up authentication and creating accounts in the first place is covered in [onboard users](/administration-guide/onboard/onboard-index), including [guest accounts](/administration-guide/onboard/guest-accounts).