Select a user to view effective permissions. Toggle direct grants (blue). Role-provided permissions (gray) are read-only unless removed from the role. Saving updates only direct grants.