# Machine group management

See [Who may do what](/en/docs/identity/access-model) for the access model.

An administrator can grant an agent or standalone service account management of
one local group. In **Accounts → Groups → Managers**, add the account by name.
The picker and manager list show its account type. This is a separate grant:
joining a group never makes a machine its manager.

A machine manager can add and remove users, local groups, and eligible machine
members through `POST` and `DELETE /api/accounts/groups/:id/members`. Its token
must carry `write` or `admin` scope. A scope alone grants no management rights.
Only administrators can add or remove managers; machine managers cannot appoint
themselves, manage other groups, create accounts, or assign installation roles.
A management grant grants no directory search access. Give exact directory shares
separately when the machine needs to resolve names.

Machine management applies only to local Cloud groups. It does not authorize
FreeIPA operations or lend a person's directory or Unix identity. It is direct:
membership in a group that manages another group does not confer machine
management authority for that other group.

Remove the account from **Managers** to revoke management. Each membership change
locks and checks the current grant, active account, and API key or OAuth client in
its database transaction. It checks credential expiration when the change is
admitted after those locks.
Revocation prevents the next change after it completes. Disabling the account or
revoking its key also stops further requests. A membership change already committed
is retained; revocation does not undo prior changes.

Missing grants or write scope return `403`. Disabled accounts and revoked keys
fail authentication. Invalid member selections and cycles retain the normal
membership errors. The manager UI shows errors and leaves the current rows in
place so an administrator can retry. Audit events identify the machine and
credential in metadata alongside the group and changed member; tokens are never
logged.