NirmaanOne Help
How-toReviewed 2026-09-29

Change a user's roles, or deactivate a user

Give a user a different role from Settings > Users, or deactivate someone who has left so they are signed out everywhere and can't sign in, and reactivate them if they come back.

Change a user's roles, or deactivate a user

What a person can see and do in NirmaanOne comes from the one role they hold. When someone changes job, give them the role that fits; when someone leaves, deactivate them so they can't sign in any more. Both are done from the same row on the Users list.

Before you start

  • The role you want to give exists and is active. If none fits, create or tailor one first: see Create, tailor or retire a role.
  • Permissions, in the role editor's words: the View permission on Users to see the list, the Edit permission on Users to change a role or deactivate someone, and the View permission on Roles & Permissions so the Role list can load. In the default roles only the Administrator can change a role or deactivate someone; most other default roles (from Finance Lead to Rehab Officer) can view the list but not change it.
  • To remove someone who was invited but never joined, revoke the invitation instead (see Invite users and get them signed in); only a pending invitation can be removed.

Steps

  1. Open the account menu in the top bar (your avatar and email), choose Settings, then the Users tab. The Users list opens with "People in your organization, their roles and invitation status."
  2. Type part of the person's email in Search by email, or pick Active, Invited, Invitation expired or Inactive in the status filter (All statuses to start). The grid shows each user's Role, Status, 2FA and Last sign in.
  3. To change the role: click the pencil icon on the person's row (tooltip "Edit role & access"). The Edit user panel opens on the right with their Email, Status and Last sign in, the Role list with their current role selected, and the Account active toggle.
  4. Choose the new role in Role. Its description appears under the list. A user holds exactly one organization-wide role, so the new role replaces the old one.
  5. Click Save changes (greyed out until you change something). You see "<email> updated.", the panel closes and the Role column shows the new role.
  6. To take away all access: click the ban icon on the person's row (tooltip "Deactivate"). The dialog "Deactivate user?" says "<email> will be signed out everywhere and unable to sign in until reactivated." The icon isn't shown on your own row or on invitations that haven't been accepted.
  7. Click Deactivate. You see "<email> deactivated." and the row's status becomes Inactive. (Switching Account active off in the Edit user panel and clicking Save changes does the same.)
  8. If the person comes back, click the refresh icon on their row (tooltip "Reactivate"). The dialog "Reactivate user?" says "<email> will be able to sign in again with their existing roles."; click Reactivate. You see "<email> reactivated." and the row is Active again.

What happens next

  • A role change reaches the user within about 15 minutes, when their session is next renewed, or at once if they sign out and in again. Until then they keep working with the old role's permissions.
  • Deactivation is immediate. Every session of the user ends, any AI assistant connected as them stops at its next request, and their contact under Masters > Contacts is marked inactive. Their role, their records and everything they did stay as they were, so bookings, postings and the audit trail keep a valid author. Accepted users can't be deleted, only deactivated.
  • Automations the person owned stop working. Workflow rules act as the person who last switched them on or saved them; once that person is deactivated, their runs fail with a permission error. Switch those rules off and on again yourself so they act as you (see Run errored or blocked with "permission_revoked").
  • Every change is on record. The History button in the Edit user panel ("Sign-ins, role changes and profile edits of this user.") shows who changed the role or the account, and when. See History panel and Find out who changed something.

If something goes wrong

  • The Role list is greyed out and reads "No roles available.": you lack the View permission on Roles & Permissions, or no role is active. See No access or no permission.
  • The person's old role doesn't show as selected: that role has been deactivated, so it no longer grants anything and isn't offered. Pick the role they should hold now and save.
  • Save changes answers "Role <name> is inactive and cannot be assigned": the role was deactivated while you were choosing. Reactivate it on Roles & Permissions or pick another. See Role cannot be deleted, renamed or assigned.
  • The Account active toggle is greyed out with "You cannot deactivate your own account.": another user with the Edit permission on Users has to do it. See Role cannot be deleted, renamed or assigned.
  • The pencil or ban icons aren't there: you lack the Edit permission on Users. See No access or no permission.
  • A deactivated user trying to sign in sees "This account has been deactivated. Contact your administrator." That is expected; reactivate them if they should be back. See Cannot sign in.

Related

  • UsersScreen

    The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.

  • Roles & PermissionsScreen

    The list of your organization's roles: open one, create or clone a role, deactivate or reactivate it, and delete custom roles nobody holds.

  • Edit roleScreen

    Change a role's name, description, active flag and permissions, see who holds it, and open its History.

  • AI connectorsScreen

    Connect Claude, ChatGPT or another AI assistant to NirmaanOne so it can act as you, see what your connections have done, and disconnect them; administrators see and revoke everyone's.

  • Audit logScreen

    The organization-wide change log: every create, change and delete, every sign-in (including refused ones), sign-out and downloaded file, with who did it, when, from where and what changed.

  • History panelScreen

    See who changed a record, what they changed and when, including the record's lines, newest first, and jump to the full audit log.

  • Invite users and get them signed inHow-to

    Invite a colleague from Settings > Users with the role they will hold, and walk them through the invitation email to their first sign-in; resend the invitation when the link has expired.

  • Create, tailor or retire a roleHow-to

    Make a new role from scratch or as a copy of an existing one, tick the permissions it grants per module, tailor a default role to your organization, retire a role you no longer need, and give the role to users.

  • Find out who changed somethingHow-to

    Open a record's History to see who changed it, when and what the values were before and after, then follow it into the Audit log to narrow by person, action or date and see everything saved in the same request.

  • User accounts: invitations, status and sign-inConcept

    How a person gets an account (by invitation), the four user statuses and how they are derived, how long an invitation link lives, what happens at sign-in with and without two-factor authentication, how long a session lasts, and what deactivation does.

  • Roles and permissionsConcept

    What a permission is (a module plus an action), how roles bundle permissions, the twelve default roles and what each is meant for, the one-role-per-user rule, and when a change reaches a signed-in user.

  • "No access" or "You do not have permission": your role lacks a permissionTroubleshooting

    Every screen, button and picker is gated by a permission on a module; your role decides which you hold, so a missing one shows as a No access card, a refused action, a greyed-out button with a hover reason, or a picker that explains which permission it needs.

  • Role cannot be deleted, renamed or assigned; a user cannot deactivate themselvesTroubleshooting

    Default roles and roles still held by users are never deleted (deactivate them instead), the Administrator role is locked, an inactive role cannot be given to anyone, you cannot switch off your own account, and only active users of your organization can own opportunities, tasks and workflow actions.

  • Cannot sign in: wrong password, pending invitation, deactivated account or a rejected codeTroubleshooting

    The sign-in form, the two-factor step or a password form refuses you: what each message means, the rule behind it and how to get back in.

  • Run errored or blocked with "permission_revoked": the rule's owner no longer holds a permission its actions needTroubleshooting

    A rule's automatic runs act as the person who last saved or switched the rule, and manual runs as the person who pressed the button; each action is checked against that person's permissions when it runs, so a role change or a deactivated user makes the run fail until the permission is restored or someone who holds it takes the rule over.