Configure Cross-Group Access

Cross-Group Access allows Administrators to create controlled bridges between specific groups - enabling users of one group to see or interact with resources belonging to another group, without granting full account-wide access. This is distinct from multi-group user membership because it applies at the group level: every member of the configured group inherits the cross-group access rule.

A common scenario is a Security Operations team (Group B) that needs to audit certificates owned by the Infrastructure team (Group A) without having access to the Finance team's certificates (Group C). A cross-group rule grants Group B visibility into Group A's resources under a defined scope, while Group C remains entirely separate.

Configuring Cross-Group Access

Log in as an Administrator and navigate to Settings > Groups. Click View next to the group whose members should receive cross-group access - in the example above, Group B (Security Operations).

The Group Detail page opens. Scroll down to the Cross-Group Access section. This section lists any groups that members of this group are currently permitted to access, along with the permitted scope for each link.

📷 Screenshot: Group Detail page - Cross-Group Access section (empty state)

Show the Cross-Group Access section on the Group Detail page in its empty state, with the Add or Configure button visible. Annotate the section heading and the Add button.

Click Add or Configure to open the cross-group access controls. Select the group or groups whose resources members of this group should be able to reach. For each group selected, specify the permitted scope.

Group scope is the most commonly used setting for collaboration scenarios - it allows members of this group to see all records belonging to all members of the target group. Own scope is the narrowest cross-group access and is rarely used in isolation. All scope is equivalent to account-wide access for that module and should be used with caution.

📷 Screenshot: Cross-Group Access configuration panel

Show the cross-group access configuration panel with the group selector (one group selected), the scope radio buttons or dropdown showing Own / Group / All options, and the Save button. Annotate the Group scope option as the recommended choice for most scenarios.

Click Save. The cross-group rules take effect immediately for all current and future members of this group.

📷 Screenshot: Group Detail page - Cross-Group Access section (configured state)

Show the Cross-Group Access section after a rule has been saved, displaying the target group name, the permitted scope, and options to edit or remove the rule.

Important Considerations

Cross-group access overrides the "Limit this user to specific groups" setting for the configured groups. This means that if a user is limited to Group B by their individual user setting, but Group B has been granted cross-group access to Group A's resources, that user will still be able to see Group A's resources through the cross-group rule.

Granting Group scope or All scope in a cross-group rule can expose a large volume of data. Always apply the minimum necessary scope. Review all cross-group rules periodically as team structures change, since rules created for a specific project or purpose may persist beyond their intended lifetime.