One person's page, opened from the Users tab. It is a set of cards.
Details and role
First name, last name, phone, email, one department and one role. Save writes them. A role change updates the person's permissions within seconds, but it does not sign them out.
You cannot assign a role that carries permissions you do not hold yourself. The error says so.
Activate or deactivate
The same buttons as the list. Deactivating signs the person out immediately and keeps their history. You cannot deactivate yourself.
Change password
An administrator can set a new password for the person; it takes effect immediately and signs them out of every device. It follows the usual rule: at least 8 characters with an uppercase letter, a lowercase letter, a digit and a symbol. Nothing is emailed, so tell them.
Custom permissions
Extra permissions for this one person, on top of their role. They add and never subtract. You can tick only permissions you hold yourself, and never those that belong to platform operation. Use this for an exception; if several people need the same thing, make a role.
Granted permissions
A read-only summary of what the person ends up with, from their role and their extras.
Warehouse access
Shown only if the Inventory module is installed and you may manage warehouse access: which warehouses the person can work in.
Delete and erase
Shown only to a superadmin. It permanently removes the person and erases their personal data after a typed confirmation, and cannot be undone.
If the page shows "No users"
Opening the page of a protected account (one that holds platform-operation permissions) shows "No users" instead of an explanation. That is the protection working: a tenant administrator cannot view such accounts.