Hi Kalyan,

Thanks for your comment. However, it is highly advisable to use Groups in the described scenario, as Groups will avoid human error-prone issues. In case you provide users Users instead of roles is harder to manage and therefore to remove roles instead of grouping them into groups and give assign groups to users instead.

For instance, if all users should have the create_tickets role, if you assign it individually to each user in case of the internal policy change that only supervisors should have that role you must go into every user to remove the create_tickets roles, on the other hand if you create a group Employees and another Supervisor, assuming that in the first instance both groups have the create_ticket role, when/if the policy change to only supervisors are allowed to create tickets, then the only thing that must be done is to remove the create_ticket role from the Employees group and all users assigned with this group will lose the create_tickets permission.

Thanks,