> For the complete documentation index, see [llms.txt](https://docs.certinext.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.certinext.io/documentation/user-roles-and-access-control/group-management/configure-cross-group-access.md).
# Configure Cross-Group Access
Cross-Group Access allows Administrators to create controlled bridges between specific groups - enabling users of one group to see or interact with resources belonging to another group, without granting full account-wide access. This is distinct from multi-group user membership because it applies at the group level: every member of the configured group inherits the cross-group access rule.
A common scenario is a Security Operations team (Group B) that needs to audit certificates owned by the Infrastructure team (Group A) without having access to the Finance team's certificates (Group C). A cross-group rule grants Group B visibility into Group A's resources under a defined scope, while Group C remains entirely separate.
### Configuring Cross-Group Access
Log in as an Administrator and navigate to Settings > Groups. Click View next to the group whose members should receive cross-group access - in the example above, Group B (Security Operations).
The Group Detail page opens. Scroll down to the Cross-Group Access section. This section lists any groups that members of this group are currently permitted to access, along with the permitted scope for each link.
📷 Screenshot: Group Detail page - Cross-Group Access section (empty state)
*Show the Cross-Group Access section on the Group Detail page in its empty state, with the Add or Configure button visible. Annotate the section heading and the Add button.*
Click Add or Configure to open the cross-group access controls. Select the group or groups whose resources members of this group should be able to reach. For each group selected, specify the permitted scope.
Group scope is the most commonly used setting for collaboration scenarios - it allows members of this group to see all records belonging to all members of the target group. Own scope is the narrowest cross-group access and is rarely used in isolation. All scope is equivalent to account-wide access for that module and should be used with caution.
📷 Screenshot: Cross-Group Access configuration panel
*Show the cross-group access configuration panel with the group selector (one group selected), the scope radio buttons or dropdown showing Own / Group / All options, and the Save button. Annotate the Group scope option as the recommended choice for most scenarios.*
Click Save. The cross-group rules take effect immediately for all current and future members of this group.
📷 Screenshot: Group Detail page - Cross-Group Access section (configured state)
*Show the Cross-Group Access section after a rule has been saved, displaying the target group name, the permitted scope, and options to edit or remove the rule.*
### Important Considerations
Cross-group access overrides the "Limit this user to specific groups" setting for the configured groups. This means that if a user is limited to Group B by their individual user setting, but Group B has been granted cross-group access to Group A's resources, that user will still be able to see Group A's resources through the cross-group rule.
Granting Group scope or All scope in a cross-group rule can expose a large volume of data. Always apply the minimum necessary scope. Review all cross-group rules periodically as team structures change, since rules created for a specific project or purpose may persist beyond their intended lifetime.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.certinext.io/documentation/user-roles-and-access-control/group-management/configure-cross-group-access.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.