---
layout: docs
page_title: Domain Model Index
description: |-
  Reference documentation for Boundary's domain model.
---

# Overview

Boundary has a rich domain model
consisting of resources that represent
[IAM][] principals,
infrastructure,
and the means to tie them together.
This section contains information about the various resources within the domain
and how they relate to each other.

![](/img/boundary-domain-model-overview.jpg)

## Resources

A resource is any element in Boundary
to which principals may be granted [permissions][].
All resources have an ID which is unique within Boundary.

### Summary of Resources

- **[Account][]** :
  An account is a resource
  that represents a unique set of credentials
  issued from a configured [authentication method][]
  which can be used to establish the identity of a [user][].

- **[Credential][]** :
  A credential is a data structure containing one or more secrets
  that binds an identity to a set of permissions or capabilities
  on a [host][] for a [session][].

- **[Credential Library][]** :
  A credential library is a resource
  that provides [credentials][]
  of the same type and same access level
  from a single [credential store][].

- **[Credential Store][]** :
  A credential store is a resource
  that can retrieve, store, and potentially generate [credentials][]
  of differing types and differing access levels.
  It may also contain [credential libraries][].

- **[Authentication Method][]** :
  An authentication method is a resource
  that provides a mechanism
  for [users][] to authenticate to Boundary.

- **[Group][]** :
  A group is a resource
  that represents a collection of [users][]
  which can be treated equally
  for the purposes of access control.

- **[Host][]** :
  A host is a resource
  that represents a computing element with a network address
  reachable from Boundary.

- **[Host Catalog][]** :
  A host catalog is a resource
  that contains [hosts][] and [host sets][].

- **[Host Set][]** :
  A host set is a resource
  that represents a collection of [hosts][]
  which are considered equivalent
  for the purposes of access control.

- **[Managed Group][]** :
  A managed group is a resource that groups [accounts][] based on criteria
  established by a third-party service backing the [authentication method][]. It
  can be used as a principal in [roles][].

- **[Role][]** :
  A role is a resource
  that contains a collection of [permissions][]
  which are granted to any principal assigned to the role.

- **[Session][]** :
  A session is a set of related connections between a [user][] and a [host][].
  A session may include a set of [credentials][]
  which define the permissions granted to the [user][] on the [host][] for the duration
  of the session.

- **[Scope][]** :
  A scope is a [permission][] boundary modeled as a container.

- **[Target][]** :
  A target is a resource
  that represents a networked service
  with an associated set of permissions
  a [user][] can connect to
  and interact with
  through Boundary
  by way of a [session][].

- **[User][]** :
  A user is a resource
  that represents an individual person or entity
  for the purposes of access control.

## Next Steps

When getting started with Boundary,
the first resource to look at should probably be [Scopes][].
Every other resources is either contained within a scope,
or contained within another resource
that is itself contained within a scope.
That page can help you understand the structure of resources within Boundary.

[iam]: https://en.wikipedia.org/wiki/Identity_management
[account]: /docs/concepts/domain-model/accounts
[accounts]: /docs/concepts/domain-model/accounts
[authentication method]: /docs/concepts/domain-model/auth-methods
[authentication methods]: /docs/concepts/domain-model/auth-methods
[credential library]: /docs/concepts/domain-model/credential-libraries
[credential libraries]: /docs/concepts/domain-model/credential-libraries
[credential store]: /docs/concepts/domain-model/credential-stores
[credential stores]: /docs/concepts/domain-model/credential-stores
[credential]: /docs/concepts/domain-model/credentials
[credentials]: /docs/concepts/domain-model/credentials
[group]: /docs/concepts/domain-model/groups
[groups]: /docs/concepts/domain-model/groups
[host catalog]: /docs/concepts/domain-model/host-catalogs
[host catalogs]: /docs/concepts/domain-model/host-catalogs
[host set]: /docs/concepts/domain-model/host-sets
[host sets]: /docs/concepts/domain-model/host-sets
[host]: /docs/concepts/domain-model/hosts
[hosts]: /docs/concepts/domain-model/hosts
[managed group]: /docs/concepts/domain-model/managed-groups
[role]: /docs/concepts/domain-model/roles
[roles]: /docs/concepts/domain-model/roles
[scope]: /docs/concepts/domain-model/scopes
[scopes]: /docs/concepts/domain-model/scopes
[project]: /docs/concepts/domain-model/scopes#projects
[session]: /docs/concepts/domain-model/sessions
[sessions]: /docs/concepts/domain-model/sessions
[target]: /docs/concepts/domain-model/targets
[targets]: /docs/concepts/domain-model/targets
[user]: /docs/concepts/domain-model/users
[users]: /docs/concepts/domain-model/users
[permission]: /docs/concepts/security/permissions
[permissions]: /docs/concepts/security/permissions