---
id: SCR-PFM-SEC-004
title: Edit user
route: /console/{tenantId}/security/users/{userId}/edit
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Edit the member profile and manage its scoped assignments.
supports:
- JNY-PFM-SEC-003
- CAP-PFM-SEC-009
- CAP-PFM-SEC-010
permission: platform.users.read (SecurityPage view guard; editor additionally requires management authority
  and redirects when absent)
entry_from:
- /console/{tenantId}/security/users/{userId}
exits_to:
- /console/{tenantId}/security/users/{userId}
displays:
- field: Names, display name, time zone and locale fields with the sign-in address fixed.
  source: getConsoleUser
  provenance: observed
- field: Role assignments with customer, selected-workspace or supported record scope and validity.
  source: listConsoleUserAssignments
  provenance: observed
actions:
- label: Save profile
  operation_id: updateConsoleUserDetails
  permission: platform.security-access.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/users/user-edit-screen.tsx
- label: Add role
  operation_id: grantConsoleUserRole
  permission: platform.security-access.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/users/user-edit-screen.tsx
- label: Remove role
  operation_id: withdrawConsoleUserRole
  permission: platform.security-access.manage
  confirm: true
  provenance: observed
  source: react-console:components/security/users/user-edit-screen.tsx
- label: Change role scope
  operation_id: setConsoleUserRoleScope
  permission: platform.security-access.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/users/user-edit-screen.tsx
- label: Check before granting
  operation_id: checkSecurityGrant / checkTenantSecurityGrant
  permission: platform.users.read
  confirm: false
  provenance: observed
  source: react-console:components/security/users/user-edit-screen.tsx
states:
- loading
- error
validation:
- BR-CAP-PFM-SEC-009-03
- BR-CAP-PFM-SEC-010-02
- BR-CAP-PFM-SEC-010-03
- BR-CAP-PFM-SEC-010-06
- BR-CAP-PFM-SEC-010-08
- BR-CAP-PFM-SEC-010-12
- BR-CAP-PFM-SEC-014-04
patterns:
- SecurityPage guard
- EditorActionBar
- UserRolesEditor
- AsyncConfirmDialog
component: components/security/users/user-edit-screen.tsx (UserEditScreen)
evidence:
- 'react-console at baf6dae: components/security/users/user-edit-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
- react-console:components/security/page-shell.tsx:SecurityPage; lib/authz/backend-aliases.ts (Security aliases)
console_area_permission: security.access
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Edit user

## What the Screen Is For

Edit the member profile and manage its scoped assignments.

## What It Shows and Lets People Do

The page first applies member-read and Security-area guards. The editor additionally checks access-management authority and redirects to view when it is absent; it is not a read-only editor.

## States and Errors

Profile save uses the loaded version. Role addition, withdrawal and scope changes use their dedicated operations and delegation checks. Grant checks are requests used by the editor, not an independent persistent grant. Field errors and stale-version responses keep the form available for correction.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.