Access and responsibilities

A role's name does not override authorization checks. Review the actual permissions, the target account's protection and the active tenant before changing access.

Responsibility map

Identity	Intended work	Boundary
Ordinary staff	Business operations through assigned roles	No administration merely because they can sign in
Tenant access administrator	Users, roles and grants where authorised	Cannot delegate arbitrary missing permissions
Tenant owner / SUPER_ADMIN	Bounded delegation and protected tenant setup	Separate from a platform operator; owner identity and membership are protected
Platform OPERATOR	Tenants, entitlements, invitations and recovery	Uses separate /operator sign-in
Platform AUDITOR	Read tenant and platform audit information	Cannot perform operator mutations

Permission checklist

Task	Relevant permission families
Discover users / roles / permissions	user.view, role.view, permission.view
Maintain ordinary users	user.create, user.update, user.delete
Maintain roles	role.create, role.update, role.delete
Work on administrator targets	Corresponding admin.view, admin.create, admin.update, admin.delete, admin.lock or admin.unlock
Delegate approved permissions the actor does not hold	tenant.permission.grant, plus the ordinary endpoint operation authority
Maintain operating-unit grants	user.business-unit.assign; removal has a separate user.business-unit.remove API authority
Read business units	business-unit.view; active assignment choices also accept user.business-unit.assign
Configure capabilities	tenant.module.view/manage and tenant.feature.view/manage
View/manage Appearance	tenant.module.view or tenant.module.manage for entry; management requires the manage authority

The table identifies relevant authorities, not a promise that one code alone opens an entire workflow. Discovery lists, target protections, tenant capabilities and scope can add checks. Server-provided allowed actions determine which edit and assignment buttons appear.

Example: Ali can edit ordinary users but cannot see Sara in the user list without administrator-view authority. Searching again does not remove that restriction. A missing user is not evidence that the owner account was deleted.

Never use another tenant's account ID to work around a missing selection. Roles, users, units and configuration must belong to the active tenant. The backend remains authoritative even when an old browser tab still shows a button.