> ## Documentation Index > Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt > Use this file to discover all available pages before exploring further. # Overview > Reference section navigation and resource hierarchy. Covers org-level resources, GVC structure, principals, infrastructure, and asset relationships. The Reference section provides detailed documentation for all Control Plane resources. Each resource type has specific properties, permissions, and relationships that enable you to build secure, scalable applications across multiple cloud providers. *** ## Resource Hierarchy Control Plane uses a hierarchical structure where resources are scoped to provide isolation and governance: ```text theme={null} Org (Organization) ├── Principals: Users, Groups, Service Accounts ├── Governance: Policies, Quotas ├── Infrastructure: Cloud Accounts, Agents, Locations ├── Assets: Secrets, Images, Domains └── GVC (Global Virtual Cloud) ├── Workloads ├── Identities └── Volume Sets ``` *** ## Organization Isolated environment and top-level container for all resources. Configure external logging, threat detection, tracing, and organization-wide settings. *** ## Access Control Resources that control who can access what within your organization. Grant permissions to principals (users, groups, service accounts, identities) for resources in your organization. Collections of users and service accounts. Supports dynamic membership via tag-based queries. Organization members who access Control Plane via the Console, CLI, API, Terraform, or Pulumi. Programmatic access for CI/CD pipelines, automation, and API integrations. Resource limits for your organization including agents, domains, and workloads. *** ## Compute & Storage Core resources for running and managing your applications. Global Virtual Cloud - container for workloads deployed across multiple cloud locations with shared configuration. Your applications running as standard, stateful, cron, or serverless deployments with autoscaling and load balancing. Geographic regions across AWS, GCP, and Azure where your workloads can be deployed. Persistent storage for workloads with snapshots, autoscaling, and encryption. *** ## Networking & Domains Resources for routing traffic and connecting your services. Custom domain mapping with TLS certificates, CORS configuration, and path-based routing to workloads. Reserve static public IPs per location for DNS configuration and firewall rules. Secure tunneling to private networks, on-premises systems, and cloud VPCs without exposing them to the internet. *** ## Cloud Integration Resources that connect Control Plane to your cloud providers and private networks. Bridge to AWS, GCP, Azure, or NATS for identity-based access to cloud services. Credential-free access to cloud resources and private networks via workload identity federation with AWS, GCP, Azure, and NGS. *** ## Secrets, Images & Audit Resources for managing credentials, container images, and audit trails. Encrypted storage for credentials including AWS keys, Docker registries, TLS certificates, and more. Container images in Control Plane's private registry or references to external registries. Tamper-proof audit trails for Control Plane actions and custom external events from your workloads. *** ## Workload Configuration The Workload resource has extensive configuration options documented across multiple pages: Endpoints, environment variables, and debug mode Standard, stateful, cron, and serverless workloads Image references, ports, CPU, memory, and GPU Metric-based scaling, scale-to-zero, and KEDA event-driven scaling Capacity AI and resource optimization Direct load balancer and IP Sets Ingress and egress rules mTLS and external authorization Token-based authentication Mount secrets, cloud storage, and volume sets Prometheus-based metrics for advanced scaling Grace periods and shutdown behavior *** ## Key Concepts Control Plane uses a role-based access control model where **Policies** grant specific permissions to **Principals** (users, groups, service accounts, identities) for target resources. Permissions follow hierarchical "implies" relationships - for example, `manage` implies `create`, `delete`, and `edit`. A single **GVC** can deploy workloads across multiple **Locations** spanning AWS, GCP, and Azure regions simultaneously. Traffic is automatically routed to the nearest healthy instance. **Identities** provide credential-free access to cloud resources and private networks. Instead of embedding secrets in your code, workloads assume cloud-native identities (AWS IAM roles, GCP service accounts, Azure managed identities) at runtime. **Agents** create secure tunnels to private networks without exposing them to the internet. Combined with **Identities**, workloads can access databases, APIs, and services in your VPCs.