Fine-tune permissions for a single user

You can now grant or revoke individual permissions for one person from the user directory, without changing what everyone else in their role can do.

• Open a user’s detail page and use the new Permissions tab to see everything they can do as a matrix.
• Each cell shows where the permission comes from — inherited from their role, granted just for them, or revoked just for them.
• Toggle a permission to hand it to that one user, or take it away, and set whether it applies to their own records or the whole tenant. The change takes effect on their next request; no one else in the role is affected.
• Every change is recorded in an audit view — what changed, who changed it, and when.
• The tab is admin-only, and admins always hold every permission, so an admin can never be locked out.