> ## Documentation Index
> Fetch the complete documentation index at: https://docs.charlemagnelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Groups

> Organize enrolled devices into groups to apply scoped policy overrides

**Groups** let you apply a policy override to a subset of your device fleet without touching the org-wide baseline or configuring each device individually. Device groups are managed from the **Devices → Groups** tab in the dashboard.

A device belongs to at most one group at a time. If a device is moved to a different group, it immediately starts receiving that group's policy on the next agent poll.

## Creating a Group

1. Go to **Devices** and click the **Groups** tab.
2. Click **New Group**.
3. Enter a **name** (required) and optional **description**.
4. Click **Create**.

The group appears immediately and is ready to receive devices and a policy override.

## Adding Devices to a Group

Expand a group card by clicking on it, then click **+ Add device** to assign a device. The dropdown shows only devices that are currently **Active** and not already assigned to another group.

To remove a device from a group, expand the group and click **Remove** next to the device. Removed devices fall back to the org-wide policy immediately.

## Renaming or Deleting a Group

From the group row, use the **Rename** or **Delete** buttons (visible to Org Admins only).

<Warning>
  Deleting a group removes all device assignments and removes any group-scoped policy overrides. Devices in the deleted group fall back to the org-wide policy immediately. This cannot be undone.
</Warning>

## Applying a Policy to a Group

Once a group exists, configure its policy override in the [Policies](/dashboard/policies) page:

1. Go to **Policies**.
2. Select the policy type (App Config, Flow Config, DLP Config).
3. Click **Group override** and choose the group.
4. Edit the fields you want to override (unset fields fall through to org-wide).
5. Click **Save**.

## Access Control

Only **Org Admins** can create, rename, delete groups or modify device membership. Analysts and App Users can view group information but cannot make changes.

## Managing Groups via Code

For large fleets or GitOps workflows, manage groups programmatically using the Policy-as-Code CLI or Python SDK:

```bash theme={null}
# Create a group
agent-charley-cli groups create finance --description "Finance team devices"

# Assign devices by email
agent-charley-cli groups add-members finance --email alice@company.com

# Or manage via YAML alongside policy files
agent-charley-cli apply --file policies/ --groups groups.yaml
```

See [Policy as Code → Groups](/policy-as-code/groups) for the full reference.