# Authorization

## Overview

Kloudfuse authorization is built on two layers working together to define access.

- **RBAC** — A User is assigned a Role, a system-wide permission that determines what actions they can take (view, edit, admin).

- **Teams** — Users can be assigned to one or more Teams. Teams are then used to control:

- **Stream Access** — Which data streams the team can query.
  - **Label Filters** — What label filters are automatically applied to every data query.
  - **Folder Access** — Which dashboards, alerts, and other objects within Kloudfuse the team can view and manage.

## Topics

- [Role-Based Access Control](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/rbac/overview/)
- [RBAC Policy Management](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/policies/overview/)