diff --git a/src/doc/permissions.rst b/src/doc/permissions.rst index d0019c22d85ea9e5b6f2609c1087deff1d424358..7f951889e461bde5e6c056313b670e479d1f4633 100644 --- a/src/doc/permissions.rst +++ b/src/doc/permissions.rst @@ -108,16 +108,16 @@ Administration permissions There is one special permission rule that grants global administration permissions to a user or a role: ``Grant(*)P``, i.e., grant everything with -priority. This promotes the user or group to administration level, very similar -to the ``root`` user on POSIX systems, and no other rule can deny any permission -from this user or role. Thus the ``Grant(*)P`` permission should really only be -used for administration users and in no other case. So, ... +priority. This promotes a user with this role to administration level, very +similar to the ``root`` user on POSIX systems. As with any other rule, the +effect of this rule can be overriden by *Deny* rules with priority. The +``Grant(*)P`` permission should really only be used for administration users +and in no other case. .. warning:: - The ``Grant(*)P`` administration permission cannot be overruled by any other - permission rule. Be cautious when assigning administration privileges to - users and roles. + ``Grant(*)P`` is a powerful administration permission rule. Be cautious + when assigning administration privileges to users and roles. How to set permissions