Iarap Adds Permission-Level Access Control

Access in Iarap is no longer decided by role name alone.

What changed

Every role now carries a default permission template. Assigning a role pre-selects those permissions, and an administrator can then tick or untick individual capabilities for that specific user.

A user's effective access is:

(permissions from their role ∪ custom grants) \ custom denies

That means two people holding EDITOR can legitimately differ — one might also manage SEO, while another has news publishing removed.

Why deltas, not snapshots

Only the difference from the role template is stored. If the template later gains a permission, everyone holding that role picks it up automatically, while their individual customisations survive untouched.

Changes apply immediately

Permissions resolve from the database on every request rather than being baked into the session token. An access change takes effect on the affected user's next request — no sign-out, no waiting for a token to expire.

Where to find it

Open Users → Manage Access to customise an individual, or Roles & Permissions to edit the defaults a role hands out.