---
title: Give a group access
type: read-and-use
product: kei
nav_group: Get started
nav_order: 4
---

# Give a group access

In the selected workspace, open **Groups** and add the agent's user to the group that should use Kei. Then open **Policies** and grant that group only the operations and resources the workflow needs.

Keep access narrow. An agent being connected to a runtime does not give it permission to use a connector or perform a governed operation. Ask an organization owner or workspace admin to make these changes if your role does not allow them.

## Check it worked

Confirm the agent is listed in the intended group and that the group's policy covers the operation you plan to try. For a policy example, see [Create policies](/kei/policies/create-policies). For policy behavior, see [Policy priority and precedence](/kei/policies/policy-precedence).