# Principals

Principals are identities that can be granted access in Altertable. A principal can be a person using the app or a service account used by automation.

Altertable applies the same [access control](/docs/governance/access-control.md) model to both types: assign roles at the organization, environment, or catalog level depending on how much access the principal needs.

## Principal types

| Type            | Use for                                                                 | Managed from          |
| --------------- | ----------------------------------------------------------------------- | --------------------- |
| Team member     | Humans who sign in to the Altertable app                                | Organization settings |
| Service account | Automation such as CI, dbt jobs, scripts, and machine-to-machine access | Organization settings |

## Service accounts

Use service accounts instead of shared human accounts for scheduled jobs and integrations. They make ownership clearer, can be scoped narrowly, and can be rotated without affecting a person's login.

Typical uses include:

- Running ingestion or transformation jobs.
- Connecting BI tools or scripts.
- Managing deployments that need API or lakehouse credentials.
- Giving an AI client or workflow access to a specific environment or catalog.

Use the [CLI](/docs/developer-tooling/cli.md) to test a service account profile from a terminal before wiring it into CI.

After creating a service account, review its roles before using it in production. Prefer catalog-level or environment-level access when the job does not need the full organization.

Issue a management API key for a service account when automation needs the Management API. The key acts as that service account, so its requests use the same role assignments and resource scope. Store the key in a secret manager and rotate it independently of human credentials.

## Learn more

- **[Access control](/docs/governance/access-control.md)**: role scopes and recommended patterns.
- **[Authentication](/docs/lakehouse/authentication.md)**: credentials for querying the lakehouse.
- **[MCP](/docs/query-data/mcp.md)**: Governed agent access to interact with your lakehouse.