Yes, what you're describing is possible. You want to give User A the "Viewer" role but also grant them an additional "Create document" permission that Viewers don't normally have. (1) ​*Understanding the terminology:*​ (2) (1) ​*Resources*​ are the objects you want to protect (like "document") . (1) ​*Actions*​ define operations that can be performed on resources (like "create", "read", "update") . ​*Roles*​ are collections of permissions that can be assigned to users. ​*Instance*​ refers to a specific resource instance with its own permissions - this is key for fine-grained control. (3) ​*How to implement your scenario:*​ You can use ​*instance-level role assignments*​ to override or extend base role permissions. When syncing users with Permit, you can assign roles at the instance level using `role_assignments`:

await permit.api.users.sync({
  key: 'user_a',
  email: '<mailto:usera@example.com|usera@example.com>',
  role_assignments: [
    { role: 'viewer', tenant: 'tenant_a' },
    { role: 'creator', resource_instance: 'document_123' }
  ]
}) ;

This approach allows User A to have the "Viewer" role at the tenant level while having additional "creator" per

To learn more, see the sources I considered: [[1] Policy Basics](https://docs.permit.io/how-to/build-policies/policy-basics) [[2] Concepts / Glossary](https://docs.permit.io/overview/glossary) [[3] Implementing Fine-Grained Nuxt Authorization](https://www.permit.io/blog/implementing-fine-grained-nuxt-authorization)

* Yes, you can manage users and their role assignments through the Permit.io UI without writing code. (1) The ​*User Management*​ interface allows you to: • Create new users • Update existing users • Delete users • Assign roles to each user • Assign users to tenants You can access this through the User Management web interface at app.permit.io/user-management. For your specific scenario (User A with Viewer role + additional Create document permission) , you would: 1. Navigate to User Management 2. Select User A within Tenant A 3. Assign the "Viewer" role at the tenant level 4. For the additional permission, you'd need to either: • Create a custom role that combines Viewer permissions + Create document • Or use the API for instance-level role assignments (as the UI primarily handles tenant-level role assignments) The UI is designed for managing tenant-level role assignments. For more granular instance-level permissions (like giving User A create permissions on specific documents) , the SDK approach I mentioned earlier is the recommended method. (2) Would you like guidance on creating a custom role in the UI that includes both Viewer and Create p

To learn more, see the sources I considered: [[1] Policy Basics](https://docs.permit.io/how-to/build-policies/policy-basics) [[2] Implementing Fine-Grained Nuxt Authorization](https://www.permit.io/blog/implementing-fine-grained-nuxt-authorization)