> ## Documentation Index
> Fetch the complete documentation index at: https://magicblock-42-crank.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

> Customize authorized access through onchain restrictions on account level for user groups.

***

### Authorization Model

<img class="w-full h-auto max-w-5xl" src="https://mintcdn.com/magicblock-42-crank/A7vpMz52y_yTQtwt/images/TEE_permission.png?fit=max&auto=format&n=A7vpMz52y_yTQtwt&q=85&s=eca1957430287c43c8a11679a5c9afa8" width="1142" height="653" data-path="images/TEE_permission.png" />

Private Ephemeral Rollups use a Permission Program to manage fine-grained privacy controls for accounts and account groups. This runs on Solana L1 and can be updated on the fly.

* **Permission Groups**: Define groups with arbitrary membership and IDs via CPI. A group aggregates users and the accounts governed by its permissions.
* **Permissions**: Add permissions to groups. Today a permission implies read access for the delegated account; read/write splits may be added in the future.
* **Access**: Client access to permissioned ER state requires authenticating ownership of a specified public key. Successful authentication yields a token used to query the ER.

<Note>
  TEE Ephemeral Rollup DevNet endpoint: [https://tee.magicblock.app/](https://tee.magicblock.app/)
</Note>

This abstraction into groups lets you modify the permissions for many users/accounts atomically in a single transaction.

<CardGroup cols={2}>
  <Card title="Program Implementation" icon="code" href="/pages/private-ephemeral-rollups-pers/how-to-guide/program-implementation" iconType="duotone">
    Add permissions via CPI
  </Card>

  <Card title="Client Implementation" icon="browser" href="/pages/private-ephemeral-rollups-pers/how-to-guide/client-implementation" iconType="duotone">
    Attestation, challenge, and access
  </Card>
</CardGroup>