Access control in iControl makes use of the concept of domains. A domain is a logical grouping of users, resources and applications.

Domains are specified using dot notation (e.g. myCompany.com), and are hierarchical—there is typically one top level domain for a company, with several lower level domains organized in some pattern. For example, a company might have myCompany.com as the top level domain, and then one lower level domain per city (e.g. montreal.myCompany, toronto.myCompany).