Assigning principals to policies
The Principals tab on the policy page displays a list of principals in your organization assigned to an AI policy and lets you add or remove them. The following principals exist:
Users: individual human users in your organization who have AI access.
Groups: groups of users in your organization who have AI access. Assigning a policy to a group applies it to every member, including members of nested groups.
Service accounts: non-human identities in your organization that have AI access.
You can assign a user, group, or service account to one or multiple AI policies, remove them from a policy, and view which policies they are assigned to. When a principal is assigned to multiple policies, effective settings are calculated according to certain rules.
Users and service accounts must be granted AI access before any policy applies to them. If the AI access is revoked, the principal remains assigned to the policy, but the policy settings no longer apply to them. When the principal regains AI access, the policy settings apply again.
Direct and group-based policy assignment
A user can be assigned to a policy directly, through one or multiple groups, or both. If a user is a member of a group, the policy automatically applies to them when you assign that group to the policy. The policy continues to apply to the user as long as at least one of these assignments remains, and it stops only when you remove all of them.
Groups can be nested. Members of a child group are also members of its parent group, so assigning a parent group to a policy also assigns its child groups.
Manage assignments
View principals assigned to a policy
In the sidebar, under AI governance, select Policies.
If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary permissions.
In the table, click the policy name to open its page.
On the policy page, click the Principals tab.
Select the Users, Groups, or Service accounts tab.
The table displays the principals assigned to the policy. The Also in other policies column shows the other custom policies to which the principal is also assigned. If a principal is assigned to more than one policy, the column lists the first one and shows a +N indicator for the rest. Hover over this indicator to see the other policies.
On the Groups tab, the Members column shows the group's total member count, including members it gains through nested groups.
Assign principals to a policy
In the sidebar, under AI governance, select Policies.
If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary permissions.
In the table, click the policy name to open its page.
On the policy page, click the Principals tab, then click the Users, Groups, or Service accounts tab.
Click Assign and, in the dialog, select one or multiple users, groups, or service accounts in the dropdown.
Click Add to confirm.
In the upper right corner, click Save to save the policy changes.
In the dialog, review the changes and click Save.
A success message appears in the lower right corner, and the selected principals are assigned to the policy.
Remove principals from a policy
In the sidebar, under AI governance, select Policies.
If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary permissions.
In the table, click the policy name to open its page.
On the policy page, click the Principals tab.
Select the Users, Groups, or Service accounts tab.
In the table, find the principal you want to remove, click
in the corresponding row, and select Remove user, Remove group, or Remove service account from the dropdown. To remove multiple principals, select them using the checkboxes in the first column and click Remove users, Remove groups, or Remove service accounts on the toolbar below the table.
In the dialog, click Remove to confirm the action.
In the upper right corner, click Save to save the policy changes.
In the dialog, review the changes and click Save.
A success message appears in the lower right corner, and the principal is removed from the policy. The policy settings no longer apply to them.