Administrative management of access roles, groups, and the accounts that are members of them. There is a set of pre-defined immutable roles and groups, but others can be added or removed dynamically.