Managing user permissions

How do I find the user?

Open Admin, select Users & access, then select a row in the user directory. Search name or email, account-status filters, and the role filter can narrow the list. The user panel shows the account email, Status, Roles, Groups, and Permission overrides in one place.

Access to the page and permission to change it are separate. User status changes require user management access. Role and permission-override changes require permission management access and a server policy that allows the current administrator to grant them. Group membership changes require both user and Group management access.

How do I assign roles with the smallest useful scope?

A user may have more than one role when their duties differ by scope. Remove an assignment with its remove control when it is no longer needed. Some locked roles cannot be granted or removed from this screen. Legacy Admin accounts show a warning and should be migrated through Replace legacy access or Assign a role instead by another authorized administrator.

1. 1In Roles, select Role guide to compare the available roles and their intended use.
2. 2Select Add role.
3. 3Choose a Role from the definitions your account is allowed to grant.
4. 4Choose its Scope. Available choices are shown as Org-wide, Group · [name], or Location · [name], depending on what that role permits.
5. 5Add the role, then confirm that it appears with the expected scope. A duplicate role-and-scope combination is rejected.

How do Groups and permission overrides work?

The Groups section controls directory Group membership. Select or clear a Group checkbox and wait for the success message before making another Group change. If membership data cannot be loaded, TankActive disables Group editing instead of guessing the current state.

Permission overrides grant individual capabilities beyond the user's roles. Expand Permission overrides, review the capability labels, and toggle only the exception that is required. The interface recommends roles when possible because role and scope assignments are easier to review than a collection of one-off overrides.

How do I deactivate access safely?

Turn off Account is active to deactivate another user. TankActive asks for confirmation and signs that account out of all devices. You cannot deactivate your own account or the last active administrator. Reactivating the toggle lets the user log in again.

Delete user is permanent and accepts an optional reason for the audit log. Use deactivation for temporary access removal and reserve permanent deletion for an account that should no longer exist. TankActive also blocks deleting your own account and protects the last active administrator.