> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# How Access Manager works

> See how Access Manager's Auth, Identity, and product-level enforcement fit together to authenticate subjects and enforce permissions across products.

Access Manager is built from two services, and every protected Lerian product plugs into them at the route level. Together, they cover the three jobs of access control: managing access data, deciding access at runtime, and enforcing those decisions inside each product.

* **Auth** is the runtime decision layer. It issues tokens, verifies MFA, returns user information, and answers permission checks.
* **Identity** is the management layer. It stores users, groups, applications, communication providers, application-provider links, and MFA configuration.
* **Product-level enforcement** is the runtime integration inside protected products. It calls Auth before product business logic runs and is not a third Access Manager service.

For example, Identity creates a user and assigns the user to a product group. Auth issues the access token and answers permission checks for that token. The protected product enforces those decisions on every route before the request reaches the product handler.

<Card title="Auth service" icon="lock" href="/en/platform/access-manager/auth-plugin" horizontal>
  Runtime tokens, MFA verification, user information, permission decisions, and cache.
</Card>

<Card title="Identity service" icon="users" href="/en/platform/access-manager/identity-plugin" horizontal>
  Management of users, groups, applications, communication providers, and MFA configuration.
</Card>

<Card title="Product-level enforcement" icon="shield-halved" href="/en/platform/access-manager/product-level-enforcement" horizontal>
  Route-level checks inside protected Lerian products that call Auth before business logic.
</Card>

<Warning>
  Auth, Identity, and product-level enforcement do not replace each other. Identity defines access data, Auth makes authentication and authorization decisions, and protected products enforce those decisions at runtime.
</Warning>

For day-to-day usage, see [Using Access Manager](/en/platform/access-manager/using-access-manager) for the API workflow and [Access Manager via Lerian Console](/en/platform/access-manager/using-access-manager-with-midaz-console) for the visual flow.