Assign roles to a user

Use Assign roles to replace the user's complete role set. This is not an “append one role” operation. Retain every existing role that the user should keep.

Before you start

You need access to user and role discovery and authority to update the target account. New roles must pass the delegation ceiling for their contained permissions. Administrator targets and protected owners have stronger checks.

Steps

1. Open Authorization → Assign roles.
2. Search for the exact username and confirm its email.
3. Choose Assign role where offered.
4. Wait for the full role catalogue and original selection to load.
5. Review the selected count, the currently selected roles and each role's availability reason.
6. Search/page through the catalogue and select the intended final set. Keep unrelated approved roles selected.
7. Choose Assign.
8. Reopen the user/assignment to verify the full saved set.
9. Tell the affected user to sign in again; existing authorization sessions are invalidated by access changes.

Replacement example

Point	Selected roles
Before	Sales Viewer; Stock Viewer
Required change	Add Customer Receipts
Correct final set	Sales Viewer; Stock Viewer; Customer Receipts
Accidental final set	Customer Receipts only — the two original roles would be removed

Searching narrows the display, not the intended scope of the replacement. Review selections across pages; the selected count helps reveal unintended losses. If original roles cannot be resolved, the dialog blocks saving rather than silently dropping them.

Recovery

If loading fails, use Retry and wait for the original set to resolve. If a checkbox is unavailable, read its reason; a role containing powers beyond your delegation ceiling cannot be added merely because you can see its name. If the save fails or the response is uncertain, reload the assignment before retrying.

SUPER_ADMIN membership cannot be assigned, removed or copied through this workflow. Giving ordinary staff a role named after an owner is not an ownership transfer.