DBM manages global user records. All authenticated users are stored here regardless of which instances they access.
| Action | Required |
|---|---|
| View all users | USER_MODERATOR |
| Edit user profiles | USER_ADMIN |
| Assign global/entity permissions | ADMIN_MANAGER (+ access to target entity) |
| Add user to instance | ADMIN or USER_MODERATOR on instance (no user search — exact username required) |
Users in instances (cached users, devices, groups, API keys) use flag-based deletion — marked as deleted rather than permanently removed, due to the large number of associated records.
Global user deletion in DBM follows the standard two-phase pattern.
See Admin Permissions for the full model.