- Applied to all users in an account
- Used to manage network access
- Specific to individual users
- Inherited by users within a group