> ## Documentation Index
> Fetch the complete documentation index at: https://zenskar.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Users

## 1. Concepts: What a user is and how their access is determined

A **user** is anyone who can sign in to the Zenskar web application under your organization. A user's access is made up of two parts: the [role](/docs/20260301/security/role-based-access-control/roles) assigned to them, and any additional permissions granted to them individually.

### One role, plus additional permissions

Each user is assigned exactly one role at a time. That role grants a baseline set of permissions. On top of that, an administrator can grant a user extra individual permissions that are not part of their role, using the **Additional Permissions** section on the user's edit form. A user's effective access is always the union of what their role grants plus whatever additional permissions they hold individually. In the **Additional Permissions** section, the permissions coming from the user's role are shown but locked, since they cannot be removed there. Only the extra, individually granted permissions can be added or removed in that section.

### Invite-based creation

Adding a user in Zenskar is invite-based, not password-based. When you add a user, you provide their name, email, and role. Zenskar does not ask you to set a password on their behalf. The invited person receives access and sets up their own credentials.

### Two-factor authentication

2FA for a user is enabled from their row on the Users list, using the kebab menu. It requires the same [Update permission](/docs/20260301/security/role-based-access-control/roles) on the Users module as editing that user's profile, not a specific role, and it applies the same way whether the row is your own or someone else's. See [Two-factor authentication](/docs/20260301/security/two-factor-authentication) for the full explanation, including why it cannot currently be reversed.

***

## 2. Walkthrough: Invite a user, assign a role, grant an extra permission, and enable 2FA

This walkthrough adds a new teammate, assigns them a role, gives them one permission beyond that role, and requires them to set up two-factor authentication.

1. Click the account menu at the bottom of the left sidebar, then click **Users**.
2. Click **Add New User**.
3. Fill in **First Name**, **Last Name**, and **Email**.
4. In the **Role** dropdown, search for and select an existing role, for example `Billing viewer`.
5. Click **Save User**. The new user appears in the Users list.
6. Click the new user's row to open their edit form.
7. Under **Additional Permissions**, add one extra permission that is not part of their role, for example the ability to create customers, and save.
8. Back on the Users list, open the kebab menu on the same user's row and click **Enable Two Factor Authentication**.
9. Confirm the prompt. The user will be required to set up 2FA the next time they log in.

***

## 3. How-to guides

### Add a user

1. Click the account menu at the bottom of the left sidebar, then click **Users**.
2. Click **Add New User**.
3. Fill in **First Name**, **Last Name**, and **Email**.
4. Select a **Role** from the searchable dropdown.
5. Click **Save User**.

<Info>
  Adding a user sends an invitation. There is no password field, since the user sets up their own access after accepting the invite.
</Info>

### Edit a user

1. On the **Users** page, click the user you want to edit.
2. Update **First Name**, **Last Name**, or **Role** as needed.
3. Click **Save User**.

<Info>
  The user's email address cannot be changed after the user is created.
</Info>

### Grant additional permissions beyond a user's role

1. Open the user's edit form.
2. In the **Additional Permissions** section, use the search box to find the permission you want to add, and move it into the granted list.
3. Click **Save User**.

The permissions already granted by the user's role appear in this section too, but locked, since they cannot be removed here. To remove a permission that comes from the role itself, change the user's role or edit the role's own permissions instead.

### Delete a user

1. On the **Users** page, open the kebab menu on the user's row.
2. Click **Delete**.
3. Confirm the deletion.

### Enable two-factor authentication for a user

1. On the **Users** page, open the kebab menu on the user's row.
2. Click **Enable Two Factor Authentication**.
3. Confirm the prompt.

The user is required to set up 2FA the next time they log in.

<Note>
  This action is one-way. See [Two-factor authentication](/docs/20260301/security/two-factor-authentication) for details.
</Note>

***

## 4. Reference

### Location

Click the account menu (your name or avatar) at the bottom of the left sidebar, then click **Users**. The same menu also lists **Roles**, **Settings**, and **Logout**.

### Fields

| Field                  | Where      | Editable | Notes                                                                                                                                |
| ---------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| First Name             | Add / Edit | Yes      |                                                                                                                                      |
| Last Name              | Add / Edit | Yes      |                                                                                                                                      |
| Email                  | Add        | Set once | Cannot be changed after the user is created                                                                                          |
| Role                   | Add / Edit | Yes      | Single selection, searchable dropdown                                                                                                |
| Additional Permissions | Edit only  | Yes      | Extra individual permissions beyond the role. The role's own permissions are shown here locked and cannot be removed in this section |

### List columns

| Column     | Description                                                                |
| ---------- | -------------------------------------------------------------------------- |
| First Name | The user's first name                                                      |
| Last Name  | The user's last name                                                       |
| Email ID   | The user's email address                                                   |
| Added On   | The date the user was added                                                |
| Two Factor | Whether two-factor authentication has been required or set up for the user |

### Permission precedence

A user's effective permissions are the union of the permissions granted by their assigned role and any additional permissions granted to them individually. Removing a permission from the user's role affects everyone with that role; removing an additional permission only affects that one user.

| Source                 | Where managed                                                    | Removable per-user?                                           |
| ---------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------- |
| Role permissions       | [Roles](/docs/20260301/security/role-based-access-control/roles) page | No, shown locked on the user's Additional Permissions section |
| Additional permissions | User's Additional Permissions section                            | Yes                                                           |