Group detail

A group's page is where you change what the group grants and who belongs to it. Open it by selecting a card on Groups (opens the admin console); All groups takes you back.

Two permissions share the work on this page: Manage groups changes what a group can do and its settings, while Manage users changes who is in it. Someone holding only one of them sees the other half read-only.

Header

The group's colour, name, a System badge on built-in groups, and its description. People with Manage groups see Clone and — on groups you created — Delete.

Built-in groups show a note: "This is a built-in system group. Its name and permissions are locked to keep the access model consistent — clone it if you need a variant." The database enforces the lock, so nobody can edit a system group's permissions, name or existence.

The page has up to three tabs: Permissions, Members, and Settings (only on groups you created, and only for people with Manage groups).

Permissions

Headed What members of this group can do: every permission, sorted into Content, Taxonomy and Administration, each with its plain-language description. Ticked means the group grants it. For the meaning of each one, see Permissions.

Ticking or unticking a box saves immediately — "Permission granted" or "Permission removed" confirms it — and applies to every member of the group at once, from their next action. If the change affects your own access, your menus update straight away. The checkboxes are locked on system groups and for anyone without Manage groups.

The database refuses two kinds of change, and the box flips back with the reason:

• Granting a permission you do not hold — "You can only grant permissions you hold yourself", with the permission's key in brackets.
• Removing the last route to management — taking Manage users or Manage groups off a group is refused if nobody active would still hold it in your agency.

Members

Everyone in the group, by name and email; select a name to open that person's page.

People with Manage users also get:

• Add a member… — a list of people in your agency who are not yet in the group ("Everyone is a member" when there is nobody left to add). Picking someone adds them at once: "Added to" and the group name confirms it.
• A remove button on each member's row. It takes effect immediately, with no confirmation.

"No members yet." means the group is empty. The database applies the same rules here as on a person's page: you can only add people to a group whose permissions you hold, adding anyone to Admin needs Manage groups, you cannot add yourself, and the agency must keep an active holder of Manage users and Manage groups.

Settings

Only on groups you created. Change the Name, Description or Color (pick from the swatch or type a hex value such as #888888) and select Save changes; "Group updated" confirms it. The colour appears as a dot beside the group's name in lists across People & access.

Clone

Clone opens the new-group dialog filled with this group's name plus "copy", its description and its permissions. Members are not copied. Cloning is the way to make an editable version of a system group — details on Groups.

Delete

Delete appears only on groups you created. A confirmation names the group and warns: "Members lose any access this group granted. Content they authored is unaffected. This cannot be undone." Select Delete group to go ahead; you return to the Groups list.

• Every membership of the group is deleted with it, so its members lose whatever only this group gave them. Their other groups are untouched.
• An access code that granted this group shows Deleted group in its Grants column and no longer grants it.
• The deletion is recorded in the audit log as "Deleted group".
• The database refuses the deletion if it would leave your agency with no active holder of Manage users or Manage groups.

Why you can only grant what you hold

Every route into a group — ticking it on a person's page, adding a member here, choosing it in an invitation, or putting it on an access code — is checked against your own permissions. You can place people only in groups whose permissions you already hold, you can grant a group only permissions you hold, adding anyone to Admin also needs Manage groups, and you can never add yourself to a group. That stops anyone with partial access from handing themselves, or a friend, more than they have.