# Roles and permission presets

> Reuse named permission sets for users and invitations, and explicitly apply role edits to existing users.

## Permissions remain the access boundary

Roles are named presets of assignable permissions. Applying one copies the grants onto a user or
invitation. Endpoints continue to check individual permissions, and the UI mirrors those checks.
See [adding a permission](/docs/adding-a-permission).

Admins can create and edit presets in the role editor, then select them in the user permission
editor or when [inviting users](/docs/user-invitations). An actor can save or assign only permissions
they hold. Self-service and superadmin capabilities are outside role presets.

## Push an edit deliberately

Editing a role does not silently change existing users. Choose the apply option when saving, or
use the standalone apply action, to replace assignable grants for users stamped with that preset.
The UI shows the affected user count. Applying requires its own permission, skips superadmins and
the acting user's account, audits changes and evicts their authorization caches.

Manually changing a user's grants away from a preset clears its stamp. Deleting a role clears
stamps but preserves the permissions already copied onto users and invitations.

The repository references are `docs/api/roles.md` and `docs/frontend/roles.md`.

## Verify

- Create a preset, apply it to a user, edit it and confirm the user's grants remain unchanged until apply.
- Apply the edit and confirm affected users receive the updated assignable grants.
- Delete the preset and confirm copied access remains intact.