Per-user exceptions to role defaults
Permission overrides let you grant or deny a single permission to a single user, without changing the role that user belongs to. Use them when one person needs an exception, for example an editor who should see a feature that is denied for the Editor role, or an admin who should not see a specific feature.
Overrides live in the Role Management drawer, under the Overrides tab.
What an override does
An override is tied to one user and one permission.
Allow grants that permission to the user even if the role does not have it.
Deny removes that permission from the user even if the role has it.
Role defaults stay untouched. The exception applies only to that user.
Create an override
Open the Role Management drawer (Roles button in the Users page, or from the Menu Management drawer).
Go to the Overrides tab.
Pick the user (search by name, username, or email).
Pick the permission you want to override.
Choose the override type: Allow or Deny.
Optionally add a reason (why the exception exists) and an expiration date for temporary overrides.
Save. The new override appears in the Active Overrides list.
Active overrides
The Active Overrides section lists current overrides, either all overrides or the overrides for a selected user. Each entry shows the user, the permission, and the type (allow or deny), and can be deleted to return the user to role defaults.
Notes
Plan restrictions still apply. If your plan does not include a feature, an Allow override cannot unlock it. The form warns you when that happens.
Expiration is required for temporary overrides. Without an expiration date, the override stays active until you delete it.
Deny wins over role defaults. A Deny override removes access even for users whose role normally grants the permission.