Access in ioMoVo is built from roles and groups rather than per file access lists, which keeps large libraries manageable as your team changes.

An access decision is evaluated at the moment of the request, against the user's current role and group membership. It is not a copy of permissions taken at the time a role was assigned.

The practical consequence is that a change to someone's role or group takes effect for their next request rather than requiring a rebuild or a reindex.

A role describes what a person can do. A group describes who they belong with. Most teams map groups to their existing directory groups and attach roles to those, so that joining or leaving a team in your directory carries the right access with it.

Where you can, drive membership from your identity provider rather than maintaining it by hand in two places. Manual membership is the most common source of stale access.

When access is revoked, it propagates to the primary asset, its contents, and its proxies. Someone who loses access to an asset does not retain a working route to a lower resolution copy of it.

When you audit, look at tenant membership and group membership together. A user with an ioMoVo account who is not a member of your tenant has no access to your content, so the account list on its own will overstate your exposure.

Single sign on and how accounts join your tenant covers how membership is granted. Removing a user's access covers offboarding.