boundary/website/content/docs/concepts/index.mdx

---
layout: docs
page_title: Concepts
sidebar_title: Concepts
description: |-
  An introduction to Boundary concepts and architecture.
---


# Concepts
Boundary is a tool for managing identity-based access for modern, dynamic infrastructure. Just as infrastructure itself can be complex, at first glance Boundary can seem complex as well. As a result, it's helpful to understand how Boundary organizes security principals and resources, as well as how it allows you define granular permissions to those principals. A glossary of terms is contained in the [domain model](/docs/concepts/domain-model) section.

# Identity & Permission Management
Identity is a core concept in Boundary. Identity is represented by two types of resources, mapping to common security principals:

* [Users](/docs/concepts/domain-model/users), which represent distinct entities that can be tied to authentication accounts
* [Groups](/docs/concepts/domain-model/groups), which are collections of Users that allow for easier access management

[Roles](/docs/concepts/domain-model/roles) map users and groups to a set of [grants](/docs/concepts/domain-model/grants), which provide the ability to perform actions within the system.

# Resource Management
Boundary enables flexible management of the hosts and services for which it can broker access. Boundary administrators define [host catalogs](/docs/concepts/domain-model/host-catalogs) that contain information about [hosts](/docs/concepts/domain-model/hosts). These hosts are then collected into [host sets](/docs/concepts/domain-model/host-sets) which represent sets of equivalent hosts. Finally, [targets](/docs/concepts/domain-model/targets) tie together host sets with connection information. Final access to a resource is granted via [roles](/docs/concepts/domain-model/roles) that provide authorization to create sessions against these targets.

# Next Steps 
Be sure Boundary is able to run locally with the instructions at [Getting Started](/docs/getting-started). Then, learn how to create targets and initiate a session with [Connect to Your First Target](/docs/getting-started/connect-to-target).

# Further Reading
For more information see our general recommendations for [deployment architecture](/docs/installing/production), and see the [security model](/docs/concepts/security-model) documentation for an explanation of the security foundations of Boundary.