# Account onboarding

A tenant reaches Switchboard in two moves, and neither deploys an app.

**1. The account is invited.** On the switchboard app's Access tab, an
operator invites the tenant's account and assigns it the Switchboard
Application — the same gesture any app uses to grant any account access.
Identity is Frontegg end to end; the person who accepts the invite is the
tenant's first admin.

**2. An AWS account is connected.** Connecting an account provisions
*access*, not infrastructure: the connection registers the account, and
aws-bootstrap CI reconciles the catalog — the GitHub OIDC deploy roles,
the `SwitchboardAccess` role Switchboard assumes, permission boundaries,
artifact buckets. Switchboard reads the connection stack's outputs back on
verify (provider ARN, exec roles, artifact buckets, the CodeBuild
project). Git remains the authority; Switchboard never edits IAM policies
directly.

Only after both does anything run: the tenant creates an
[environment](/concepts/environments-and-instances) on the connection and
installs from the marketplace.

Connections are console territory — the GraphQL API behind this gateway,
not the REST surface in the [API reference](/api).