Create, edit and remove users
The user is the sign-in. Removing one is how access ends; leaving a disabled account around is how it does not.
/
Users & Roles
Users & Roles decides who may sign in and what they may do once they have. Roles are built from the 335 named permissions, and viewing a role is permissioned separately from changing one.
Try it in the demousers roles · 3 tasks
Before you start
- A list of the jobs people actually do. Build roles from jobs, not from people — a role per person is a permission system with no rules in it.
What Users & Roles does
Who may sign in, and what they may do once they have.
Build roles from named permissions
Every permission has a name and a meaning. Start from the smallest role that lets somebody work, and add on request — the reverse process never happens.
Let people see a role without changing it
Viewing and editing roles are separate rights, so a manager can check what their team can do without being able to widen it.
Worth knowing
- The commonest failure in a suite this size is one enormous role called "staff". Splitting it later means auditing everything that was done under it.
What it claims to do
The capability list this guide is written against, unabridged. Nothing above adds to it.
Users & Roles on the Administration page- Users created, edited and removed
- Roles built from the 335 named permissions
- Roles viewed separately from being changed
Where it connects
The modules Users & Roles hands work to, or takes it from. Most problems that look like one module are a handover between two.